Universal Adversarial Perturbations

Seyed-Mohsen Moosavi-DezfooliAlhussein FawziOmar FawziPascal Frossard

article2016CVPR2,860 citations

Reveals that deep neural networks can be systematically fooled on nearly all natural images using a single, image-agnostic perturbation vector that transfers across different model architectures.

Listen

The article addresses the vulnerability of modern image classifiers to small, fixed changes in input. State-of-the-art deep networks achieve high accuracy on natural images yet can be misled by tiny alterations that are nearly invisible to people. This matters because such networks are now deployed in real environments where an adversary could exploit any consistent weakness.

The work set out to determine whether a single perturbation vector exists that fools a given classifier on most natural images while remaining small in norm. The authors developed an iterative algorithm that starts with a zero vector and repeatedly adds the smallest change needed to push each successive training image across the decision boundary, projecting the result back onto a ball of allowed radius after every step.

Experiments on six well-known architectures trained on ImageNet show that the resulting vectors achieve fooling rates between 78 percent and 93 percent on held-out validation images. The same vectors also transfer across networks, with some fooling more than half the images of unrelated models. Visual inspection confirms the perturbations remain quasi-imperceptible, and even vectors computed from only five hundred images retain substantial effectiveness.

These results indicate that the decision boundaries of current networks contain large geometric correlations; a low-dimensional subspace captures the normals to the boundary near most natural images. Consequently, a single direction in that subspace can move many points into wrong classes. The finding implies that current robustness claims based on per-image perturbations may understate practical risk, since an adversary needs only one vector rather than a new optimization for each input.

Fine-tuning a network on images augmented with several such vectors lowers the fooling rate modestly but does not eliminate the vulnerability. The authors therefore recommend further geometric analysis of decision boundaries and the design of training procedures that explicitly penalize shared directions across many points. The main limitations are the restriction to image classification on ImageNet-scale data and the lack of a theoretical bound on the minimal size of a universal perturbation; results should be treated as empirical evidence rather than a complete characterization.

CNRS École Normale Supérieure de Lyon École Polytechnique Fédérale de Lausanne INRIA LIP Université Claude Bernard Lyon 1 Université de Lyon probability svm convolutional neural networks universal adversarial perturbations image-agnostic perturbation cross-model universality

arXiv: 1610.08401 LTS4/universal

Paper: DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks, Seyed-Mohsen Moosavi-Dezfooli et al. (2015). DeepFool introduces the iterative boundary-projection optimization technique that serves as the direct algorithmic foundation adapted by universal adversarial perturbations.
Paper: Explaining and Harnessing Adversarial Examples, Ian J. Goodfellow et al. (2015). This foundational work establishes the linear hypothesis of adversarial vulnerability and introduces standard gradient-based perturbation frameworks on image classifiers.
Paper: Intriguing properties of neural networks, Christian Szegedy et al. (2014). This seminal paper first uncovered the existence and cross-model transferability of adversarial perturbations in deep neural networks.
Paper: The Limitations of Deep Learning in Adversarial Settings, Nicolas Papernot et al. (2015). It provides crucial background on Jacobian-based saliency and targeted adversarial perturbations on deep learning architectures.
Paper: Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks, Nicolas Papernot et al. (2015). It establishes defensive distillation and key geometric insights into the vulnerability of decision boundaries against adversarial perturbations.
Paper: Deep neural networks are easily fooled: High confidence predictions for unrecognizable images, Anh Nguyen et al. (2014). This work demonstrates high-confidence misclassifications on unrecognizable inputs, illustrating the fundamental unreliability of deep neural network decision spaces.

Paper: Towards Deep Learning Models Resistant to Adversarial Attacks, A. Ma̧dry et al. (2017). This paper advances adversarial robustness by formalizing min-max robust optimization and introducing projected gradient descent to defend against comprehensive perturbation sets.
Paper: Towards Evaluating the Robustness of Neural Networks, Nicholas Carlini et al. (2016). It develops powerful optimization-based evaluation attacks across multiple norm constraints that rigorously assess empirical defenses inspired by adversarial vulnerability findings.
Paper: Ensemble Adversarial Training: Attacks and Defenses, Florian Tramèr et al. (2018). It investigates why single-step adversarial defenses fail to generalize and proposes ensemble adversarial training to mitigate transferred perturbations.
Paper: Adversarial Examples Are Not Bugs, They Are Features, Andrew Ilyas et al. (2019). This work deepens the theoretical understanding of universal and transferable perturbations by showing that adversarial examples arise from predictive non-robust dataset features.
Paper: Practical Black-Box Attacks against Machine Learning, Nicolas Papernot et al. (2017). It extends the practical threat of transferable perturbations by constructing black-box adversarial attacks that fool remote machine learning APIs without model access.
Paper: Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples, Anish Athalye et al. (2018). It investigates the pitfalls of heuristic defenses designed against adversarial perturbations, demonstrating how gradient masking yields a false sense of security.
Paper: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks, Francesco Croce et al. (2020). It provides a standardized, parameter-free evaluation suite to test whether classifiers truly withstand the full spectrum of adversarial attacks.
Paper: Certified Adversarial Robustness via Randomized Smoothing, Jeremy M Cohen et al. (2019). It introduces randomized smoothing to establish provable, scalable certified robustness guarantees against norm-bounded perturbations on ImageNet.
Paper: One Pixel Attack for Fooling Deep Neural Networks, Jiawei Su et al. (2017). It explores the extreme geometric limit of input vulnerability by demonstrating that modifying just a single pixel can reliably deceive deep classifiers.
Paper: Theoretically Principled Trade-off between Robustness and Accuracy, Hongyang Zhang et al. (2019). It formalizes the mathematical trade-off between natural generalization and adversarial robustness, proposing the TRADES defense framework.

Cover for Universal Adversarial Perturbations

Abstract

Given a state-of-the-art deep neural network classifier, we show the existence of a universal (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable to such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze these universal perturbations and show, in particular, that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important geometric correlations among the high-dimensional decision boundary of classifiers. It further outlines potential security breaches with the existence of single directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.

Topics

probability svm convolutional neural networks classification algorithm

Keywords

universal adversarial perturbations image-agnostic perturbation cross-model universality perturbation vectors neural network classifiers fooling rates CaffeNet architecture decision boundary

1 Introduction
2 Universal perturbations
3 Universal perturbations for deep nets
4 Explaining the vulnerability to universal perturbations
5 Conclusions
References
A Appendix

Knowls

Knowl 1 — Definition of Universal Adversarial Perturbation
definition
Let $\mu$ denote a probability distribution of natural images in $\mathbb{R}^d$ , and let $\hat{k}: \mathbb{R}^d \to \{1, \dots, K\}$ be a classification model mapping an input image $x \in \mathbb{R}^d$ to an estimated class label $\hat{k}(x)$ .

A vector $v \in \mathbb{R}^d$ is defined as a universal adversarial perturbation for classifier $\hat{k}$ and distribution $\mu$ if it satisfies two conditions:
1. $\|v\|_p \le \xi$
2. $\mathbb{P}_{x \sim \mu}\left(\hat{k}(x + v) \neq \hat{k}(x)\right) \ge 1 - \delta$
where $p \in [1, \infty]$ defines the $\ell_p$ norm metric, $\xi > 0$ restricts the magnitude of the perturbation to preserve quasi-imperceptibility to human observers, and $\delta \in (0, 1)$ parameterizes the minimum required fooling rate $1 - \delta$ over all images drawn from $\mu$ .
Knowl 2 — Universal Adversarial Perturbation Computation Algorithm
algorithm
Given a sample dataset $X = \{x_1, \dots, x_m\} \subset \mathbb{R}^d$ drawn from image distribution $\mu$ , a classifier $\hat{k}$ , an $\ell_p$ perturbation budget $\xi$ , and an error parameter $\delta$ , the algorithm iteratively constructs a single image-agnostic perturbation vector $v \in \mathbb{R}^d$ .

The perturbation is initialized to $v = 0$ . In each epoch over the training set $X$ , the algorithm evaluates whether the current perturbed image $x_i + v$ changes the prediction of $\hat{k}$ . If $\hat{k}(x_i + v) = \hat{k}(x_i)$ , it computes the minimal Euclidean perturbation $\Delta v_i$ sending $x_i + v$ across the decision boundary: $\Delta v_i = \arg\min_r \|r\|_2 \quad \text{subject to} \quad \hat{k}(x_i + v + r) \neq \hat{k}(x_i)$

The accumulated perturbation is then projected onto the $\ell_p$ ball of radius $\xi$ centered at the origin: $v \leftarrow \mathcal{P}_{p, \xi}(v + \Delta v_i)$ where $\mathcal{P}_{p,\xi}(u) = \arg\min_{u'} \|u - u'\|_2 \text{ subject to } \|u'\|_p \le \xi$ .

Multiple passes over $X$ are performed until the empirical fooling rate on the perturbed set $X_v = \{x_1 + v, \dots, x_m + v\}$ satisfies $\text{Err}(X_v) = \frac{1}{m} \sum_{i=1}^m \mathbb{I}_{\hat{k}(x_i + v) \neq \hat{k}(x_i)} \ge 1 - \delta$ .
Input: Dataset $X = \{x_1, \dots, x_m\}$ , classifier $\hat{k}$ , norm constraint $\xi$ , target fooling tolerance $\delta$ , norm parameter $p$
Output: Universal perturbation vector $v$
Initialize $v \leftarrow 0$
while $\text{Err}(X_v) < 1 - \delta$ do
    for each datapoint $x_i \in X$ do
        if $\hat{k}(x_i + v) = \hat{k}(x_i)$ then
            Compute minimal perturbation $\Delta v_i \leftarrow \arg\min_r \|r\|_2 \text{ s.t. } \hat{k}(x_i + v + r) \neq \hat{k}(x_i)$
             $v \leftarrow \mathcal{P}_{p,\xi}(v + \Delta v_i)$
        end if
    end for
end while
return $v$
The minimal perturbation $\Delta v_i$ per sample is computed using efficient boundary-seeking algorithms such as DeepFool.

Knowl 3 — Fooling Rates of Universal Perturbations on Deep Neural Networks

data/table

Universal perturbations computed using an iterative projection algorithm on a training subset $X$ of 10,000 images from the ILSVRC 2012 training dataset achieve high fooling rates on both the training sample $X$ and the unseen 50,000-image ILSVRC 2012 validation set across multiple deep convolutional architectures.

Evaluation is conducted under both $\ell_2$ constraint (with $\xi = 2000$ ) and $\ell_\infty$ constraint (with $\xi = 10$ ). For scale, average natural image norms on the validation set are $\|x\|_2 \approx 5 \times 10^4$ and $\|x\|_\infty \approx 250$ .

Norm	Dataset	CaffeNet	VGG-F	VGG-16	VGG-19	GoogLeNet	ResNet-152
$\ell_2$	$X$	85.4%	85.9%	90.7%	86.9%	82.9%	89.7%
$\ell_2$	Val.	85.6%	87.0%	90.3%	84.5%	82.0%	88.5%
$\ell_\infty$	$X$	93.1%	93.8%	78.5%	77.8%	80.8%	85.4%
$\ell_\infty$	Val.	93.3%	93.7%	78.3%	77.8%	78.9%	84.0%

For CaffeNet and VGG-F, adding a single quasi-imperceptible perturbation with $\ell_\infty \le 10$ misclassifies over 93% of unseen validation images. For VGG-16, VGG-19, GoogLeNet, and ResNet-152, the universal perturbations fool between 77.8% and 90.3% of the validation set.

Knowl 4 — Cross-Model Transferability of Universal Perturbations

data/table

Universal adversarial perturbations computed for one deep neural network architecture generalize across distinct network architectures on the ImageNet benchmark, exhibiting cross-model universality.

The matrix below shows fooling rates on the 50,000-image ILSVRC 2012 validation set when universal perturbations (generated with $\ell_\infty$ bound $\xi = 10$ ) computed for the architecture in each row are evaluated on the architecture in each column:

Source Architecture	VGG-F	CaffeNet	GoogLeNet	VGG-16	VGG-19	ResNet-152
VGG-F	93.7%	71.8%	48.4%	42.1%	42.1%	47.4%
CaffeNet	74.0%	93.3%	47.7%	39.9%	39.9%	48.0%
GoogLeNet	46.2%	43.8%	78.9%	39.2%	39.8%	45.5%
VGG-16	63.4%	55.8%	56.5%	78.3%	73.1%	63.4%
VGG-19	64.0%	57.2%	53.6%	73.5%	77.8%	58.0%
ResNet-152	46.3%	46.3%	50.5%	47.0%	45.5%	84.0%

Perturbations generated on VGG-19 fool more than 53% of images on all other architectures tested, including architecturally divergent models such as GoogLeNet (53.6%) and ResNet-152 (58.0%). This demonstrates that universal perturbations are doubly universal: image-agnostic and network-agnostic.

Knowl 5 — Geometric Correlation and Low-Dimensional Normal Subspace of Decision Boundaries
model/method
The existence of universal perturbations is explained by high geometric correlations among the normal vectors to the decision boundary across natural image regions.

Let $r(x_i) = \arg\min_r \|r\|_2 \text{ s.t. } \hat{k}(x_i + r) \neq \hat{k}(x_i)$ denote the minimum adversarial perturbation vector for image $x_i$ , which is orthogonal to the decision boundary at $x_i + r(x_i)$ . The matrix collecting normalized decision boundary normals across $n$ validation images is: $N = \left[ \frac{r(x_1)}{\|r(x_1)\|_2}, \dots, \frac{r(x_n)}{\|r(x_n)\|_2} \right] \in \mathbb{R}^{d \times n}$

Singular value decomposition of $N$ on deep classifiers (such as CaffeNet) demonstrates that singular values decay rapidly compared to a matrix whose columns are sampled uniformly at random from the unit sphere. This indicates that decision boundary normal vectors across distinct natural images live in a shared low-dimensional subspace $\mathcal{S} \subset \mathbb{R}^d$ of dimension $d' \ll d$ .

A random vector of norm $\xi = 2000$ drawn uniformly from the 100-dimensional leading singular subspace of $N$ achieves a fooling rate of approximately 38% on unseen images, substantially exceeding the 10% fooling rate obtained from random isotropic vectors on the sphere of radius $\xi = 2000$ in $\mathbb{R}^d$ .
Knowl 6 — Generalization of Universal Perturbations from Small Image Subsets
empirical result
Universal adversarial perturbations require only small sample sets $X$ to generalize across large unseen validation datasets.

Evaluating the fooling rate on the 50,000-image ILSVRC 2012 validation set for GoogLeNet as a function of the size $m = |X|$ of the training subset yields:
- For $m = 500$ training images (an average of 0.5 images per class across 1,000 ImageNet classes), the universal perturbation achieves a validation fooling rate exceeding 30%.
- For $m = 1000$ training images, the validation fooling rate reaches approximately 36%.
- For $m = 2000$ training images, the validation fooling rate reaches approximately 48%.
- For $m = 4000$ training images, the validation fooling rate reaches approximately 68%.
This sample efficiency confirms that universal directions of vulnerability are shared widely across the data distribution rather than overfitting to specific training exemplars.
Knowl 7 — Comparative Vulnerability of Universal Against Alternative Perturbations
empirical result
Evaluating fooling rates on the ImageNet validation set across varying $\ell_2$ perturbation norms reveals fundamental differences between universal perturbations and alternative perturbation strategies:
- The universal perturbation computed via iterative boundary projection reaches an 85% fooling rate at $\ell_2$ norm $\xi = 2000$ , and exceeds 90% at $\xi = 3000$ .
- Adversarial perturbations computed for a single randomly selected image (via DeepFool or Fast Gradient Sign) achieve fooling rates below 35% at $\xi = 2000$ when applied globally to other images.
- The sum of sample-specific adversarial perturbations across a dataset achieves lower fooling rates than universal perturbations at small perturbation norms.
- Uniform random noise vectors sampled on the sphere of radius $\xi = 2000$ fool only 10% of images. The theoretical $\ell_2$ norm required for random noise to fool a classifier behaves as $\Theta(\sqrt{d}\|r\|_2) \approx 2 \times 10^4$ (where $d$ is the input dimension and $\|r\|_2$ is the distance to the boundary), which is an order of magnitude larger than $\xi = 2000$ .
- The ImageNet dataset mean bias achieves negligible fooling capability across norm scales.
Knowl 8 — Dominant Target Label Topology under Universal Perturbations
empirical result
Under universal adversarial perturbations, classification errors are not distributed uniformly across target classes, but instead map into a small set of dominant labels.

Constructing a directed graph $G = (V, E)$ , where vertices $V$ correspond to classification classes and a directed edge $i \to j$ indicates that the majority of images belonging to class $i$ are misclassified as class $j$ when perturbed, reveals a disconnected topology consisting of disjoint star-like connected components. Within each connected component, dozens of disparate source classes map directly to a single shared dominant label (such as 'great grey owl', 'digital clock', 'pillow', or 'quilt').

These dominant labels represent large, expansive regions in the classifier's partitioning of the high-dimensional input space into which images are systematically projected by the universal perturbation vector.
Knowl 9 — Diversity of Universal Perturbations
empirical result
Universal adversarial perturbations satisfying norm bound $\|v\|_p \le \xi$ and fooling requirements are non-unique.

Applying the iterative projection algorithm with different random permutations of the training dataset $X$ generates distinct universal perturbation vectors for the same network architecture (such as GoogLeNet with $p = \infty, \xi = 10$ ).

The normalized inner product between any pair of distinct generated universal perturbation vectors $v_a, v_b$ satisfies: $\frac{|\langle v_a, v_b \rangle|}{\|v_a\|_2 \|v_b\|_2} \le 0.1$

This indicates that multiple nearly orthogonal directions in input space can independently serve as effective universal perturbations with comparable fooling performance.
Knowl 10 — Limitation of Adversarial Fine-Tuning Against Universal Perturbations
limitation
Fine-tuning deep neural networks on universally perturbed training samples provides limited robustness and does not immunize models against newly generated universal perturbations.

Fine-tuning a VGG-F network for 5 epochs on a modified dataset—where 50% of the training samples are augmented with adaptive universal perturbations $x + \alpha v$ sampled from a pre-computed pool of 10 universal vectors (with $\alpha$ being the smallest scaling factor causing misclassification)—reduces the validation fooling rate against the original perturbations from 93.7% to 76.2%.

However, re-running the universal perturbation generation algorithm on the fine-tuned model (with $p = \infty, \xi = 10$ ) produces a new universal perturbation that achieves an 80.0% validation fooling rate. Iterating this fine-tuning and re-generation cycle multiple times fails to improve robustness beyond the ~76% fooling rate threshold.

Coverage note — None was omitted; all primary contributions—including the formal definition, iterative algorithm, empirical fooling rates across models, cross-model transferability, sample efficiency, normal vector subspace analysis, comparative baselines, dominant label graph topology, perturbation diversity, and defense fine-tuning limitations—are covered.

References

1.O. Bastani, Y. Ioannou, L. Lampropoulos, D. Vytiniotis, A. Nori, and A. Criminisi. Measuring neural net robustness with constraints. In Neural Information Processing Systems (NIPS), 2016.
2.K. Chatfield, K. Simonyan, A. Vedaldi, and A. Zisserman. Return of the devil in the details: Delving deep into convolutional nets. In British Machine Vision Conference, 2014.
3.A. Fawzi, O. Fawzi, and P. Frossard. Analysis of classifiers’ robustness to adversarial perturbations. CoRR, abs/1502.02590, 2015.
4.A. Fawzi, S. Moosavi-Dezfooli, and P. Frossard. Robustness of classifiers: from adversarial to random noise. In Neural Information Processing Systems (NIPS), 2016.
5.I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR), 2015.
6.K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
7.R. Huang, B. Xu, D. Schuurmans, and C. Szepesvári. Learning with a strong adversary. CoRR, abs/1511.03034, 2015.
8.Y. Jia, E. Shelhamer, J. Donahue, S. Karayev, J. Long, R. Girshick, S. Guadarrama, and T. Darrell. Caffe: Convolutional architecture for fast feature embedding. In ACM International Conference on Multimedia (MM), pages 675–678, 2014.
9.A. Krizhevsky, I. Sutskever, and G. E. Hinton. Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems (NIPS), pages 1097–1105, 2012.
10.Q. V. Le, W. Y. Zou, S. Y. Yeung, and A. Y. Ng. Learning hierarchical invariant spatio-temporal features for action recognition with independent subspace analysis. In Computer Vision and Pattern Recognition (CVPR), 2011 IEEE Conference on, pages 3361–3368. IEEE, 2011.
11.S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
12.A. Nguyen, J. Yosinski, and J. Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 427–436, 2015.
13.E. Rodner, M. Simon, R. Fisher, and J. Denzler. Fine-grained recognition in the noisy wild: Sensitivity analysis of convolutional neural networks approaches. In British Machine Vision Conference (BMVC), 2016.
14.A. Rozsa, E. M. Rudd, and T. E. Boult. Adversarial diversity and hard positive generation. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2016.
15.O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. Berg, and L. Fei-Fei. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, 115(3):211–252, 2015.
16.S. Sabour, Y. Cao, F. Faghri, and D. J. Fleet. Adversarial manipulation of deep representations. In International Conference on Learning Representations (ICLR), 2016.
17.K. Simonyan and A. Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations (ICLR), 2014.
18.C. Szegedy, W. Liu, Y. Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V. Vanhoucke, and A. Rabinovich. Going deeper with convolutions. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2015.
19.C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014.
20.P. Tabacof and E. Valle. Exploring the space of adversarial images. IEEE International Joint Conference on Neural Networks, 2016.
21.Y. Taigman, M. Yang, M. Ranzato, and L. Wolf. Deepface: Closing the gap to human-level performance in face verification. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1701–1708, 2014.

Citation

MLA

Moosavi-Dezfooli, S.-M., et al. “Universal Adversarial Perturbations”. arXiv, 2016, http://arxiv.org/abs/1610.08401v3.

APA

Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., & Frossard, P. (2016). Universal adversarial perturbations. arXiv. http://arxiv.org/abs/1610.08401v3

Chicago

Moosavi-Dezfooli, S.-M., A. Fawzi, O. Fawzi, and P. Frossard. 2016. “Universal Adversarial Perturbations”. arXiv. http://arxiv.org/abs/1610.08401v3.

Harvard

Moosavi-Dezfooli, S.-M. et al. (2016) “Universal adversarial perturbations”, arXiv [Preprint]. Available at: http://arxiv.org/abs/1610.08401v3.

Vancouver

1. Moosavi-Dezfooli S-M, Fawzi A, Fawzi O, Frossard P (2016) Universal adversarial perturbations. arXiv

BibTeX

@article{moosavidezfooli2016universal,
  title = {Universal adversarial perturbations},
  author = {Moosavi-Dezfooli, Seyed-Mohsen and Fawzi, Alhussein and Fawzi, Omar and Frossard, Pascal},
  year = {2016},
  journal = {arXiv},
  url = {http://arxiv.org/abs/1610.08401v3},
  eprint = {1610.08401}
}

Metadata:arXiv

Source Code

This paper has an official code repository available. Click below to access the source code.

View Repository

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

License: IEEE

Universal Adversarial Perturbations

Abstract

Topics

Keywords

Table of Contents

Knowls

Knowl 1 — Definition of Universal Adversarial Perturbation

Knowl 2 — Universal Adversarial Perturbation Computation Algorithm

Knowl 3 — Fooling Rates of Universal Perturbations on Deep Neural Networks

Knowl 4 — Cross-Model Transferability of Universal Perturbations

Knowl 5 — Geometric Correlation and Low-Dimensional Normal Subspace of Decision Boundaries

Knowl 6 — Generalization of Universal Perturbations from Small Image Subsets

Knowl 7 — Comparative Vulnerability of Universal Against Alternative Perturbations

Knowl 8 — Dominant Target Label Topology under Universal Perturbations

Knowl 9 — Diversity of Universal Perturbations

Knowl 10 — Limitation of Adversarial Fine-Tuning Against Universal Perturbations

References

Citation

BibTeX

Source Code

Access the Paper