Universal adversarial perturbations

2016/10/26 by Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Moosavi-Dezfooli, Seyed-Mohsen +5 · 4 voices · 127 citations
Computer Science · Mathematics · #Adversarial Robustness in Machine Learning #Adversarial system #Anomaly Detection Techniques and Applications #Artificial intelligence #Artificial neural network #Classifier (UML) #Computer science #Computer security #Decision boundary #Deep neural networks #Domain Adaptation and Few-Shot Learning #Exploit #Perturbation (astronomy) #Physics #cs.AI #cs.CV #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.1610.08401

published in arXiv (Cornell University) (Cornell University) · Accepted at IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017

openalex publication_date 2016/10/26 · arxiv created 2017/03/09 · arxiv updated 2017/03/10 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/05

Abstract

Given a state-of-the-art deep neural network classifier, we show the existence of a universal (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable to such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze these universal perturbations and show, in particular, that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important geometric correlations among the high-dimensional decision boundary of classifiers. It further outlines potential security breaches with the existence of single directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.

Cited by

• The 3D Mirage: Probing and Taming 3D Hallucinations
• EGRNet: A Lightweight Semantic Segmentation Network with Edge-Gated Refinement and Adversarial Sensing
• Attacking Graph Foundation Models Through Their Shared Representation
• SCAR: Semantic Cardiac Adversarial Representation via Spatiotemporal Manifold Optimization in ECG
• Adversarial Attacks Against Deep Learning-Based Radio Frequency Fingerprint Identification
• COBRA: Catastrophic Bit-flip Reliability Analysis of State-Space Models
• Where Classification Fails, Interpretation Rises
• Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attacks
• Adversarial Examples that Fool Detectors
• Adversarial Confusion Attack: Disrupting Multimodal Large Language Models
• Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation
• Continual Audio Deepfake Detection via Universal Adversarial Perturbation
• A Theory-Inspired Framework for Few-Shot Cross-Modal Sketch Person Re-Identification
• A Novel and Practical Universal Adversarial Perturbations against Deep Reinforcement Learning based Intrusion Detection Systems
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• Benchmarking Popular Classification Models' Robustness to Random and Targeted Corruptions
• DecNefSimulator: A Modular, Interpretable Framework for Decoded Neurofeedback Simulation Using Generative Models
• Improving Network Robustness against Adversarial Attacks with Compact Convolution
• A Generative Adversarial Approach to Adversarial Attacks Guided by Contrastive Language-Image Pre-trained Model
• Quantifying the Risk of Transferred Black Box Attacks
• SAAIPAA: Optimizing aspect-angles-invariant physical adversarial attacks on SAR target recognition models
• FGGM: Formal Grey-box Gradient Method for Attacking DRL-based MU-MIMO Scheduler
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Lilith: Backdoor Generalization under Training-Inference Trigger Shift
• Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensembles
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Deep Learning Seismic Substructure Detection using the Frozen Gaussian Approximation
• Adversarial Attacks with Time-Scale Representations
• Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2
• Self-Calibrated Consistency can Fight Back for Adversarial Robustness in Vision-Language Models
• Enhancing Security in Deep Reinforcement Learning: A Comprehensive Survey on Adversarial Attacks and Defenses
• A New Type of Adversarial Examples
• Black-Box Evasion Attacks on Data-Driven Open RAN Apps: Tailored Design and Experimental Evaluation
• Constrained Adversarial Perturbation
• Structured Universal Adversarial Attacks on Object Detection for Video Sequences
• Deep Edge Filter: Return of the Human-Crafted Layer in Deep Learning
• Sequence-Preserving Dual-FoV Defense for Traffic Sign and Light Recognition in Autonomous Vehicles
• On the Adversarial Robustness of Learning-based Conformal Novelty Detection
• Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeed
• Targeted perturbations reveal brain-like local coding axes in robustified, but not standard, ANN-based brain models
• MagNet: a Two-Pronged Defense against Adversarial Examples
• ICONIC-444: A 3.1-Million-Image Dataset for OOD Detection Research
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• Machine vs Machine: Minimax-Optimal Defense Against Adversarial Examples
• SafeAMC: Adversarial training for robust modulation recognition models
• Art of singular vectors and universal adversarial perturbations
• Measurement-driven Security Analysis of Imperceptible Impersonation Attacks
• Adversarial Examples Are Not Bugs, They Are Superposition
• Sensitivity and Generalization in Neural Networks: an Empirical Study
• Understanding and Enhancing the Transferability of Adversarial Examples
• From Noise to Narrative: Tracing the Origins of Hallucinations in Transformers
• The gap between theory and practice in function approximation with deep neural networks
• Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models
• Disruptive Attacks on Face Swapping via Low-Frequency Perceptual Perturbations
• SafetyNet: Detecting and Rejecting Adversarial Examples Robustly
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Semantically Guided Adversarial Testing of Vision Models Using Language Models
• BERTector: An Intrusion Detection Framework Constructed via Joint-dataset Learning Based on Language Model
• Certifiably robust malware detectors by design
• Semantics Preserving Adversarial Learning
• SAM Encoder Breach by Adversarial Simplicial Complex Triggers Downstream Model Failures
• ETA: Energy-based Test-time Adaptation for Depth Completion
• Keep It Real: Challenges in Attacking Compression-Based Adversarial Purification
• Towards an Understanding of Neural Networks in Natural-Image Spaces
• NCCR: to Evaluate the Robustness of Neural Networks and Adversarial Examples
• Rainbow Noise: Stress-Testing Multimodal Harmful-Meme Detectors on LGBTQ Content
• Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environments
• P-CapsNets: a General Form of Convolutional Neural Networks
• The Endless Tuning. An Artificial Intelligence Design To Avoid Human Replacement and Trace Back Responsibilities
• Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
• On the Convergence of SGD with Biased Gradients
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• On the Interaction of Compressibility and Adversarial Robustness
• AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant T2I Adversarial Patches
• Emergence of Quantised Representations Isolated to Anisotropic Functions
• Robust Physical-World Attacks on Deep Learning Models
• A game-theoretic analysis of DoS attacks on driverless vehicles
• Strategies for Robust Image Classification
• DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspective
• Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation
• LaVAN: Localized and Visible Adversarial Noise
• 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation
• CAVALRY-V: A Large-Scale Generator Framework for Adversarial Attacks on Video MLLMs
• Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks
• A Structured Proximal Stochastic Variance Reduced Zeroth-order Algorithm
• Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Models
• Identifying Physically Realizable Triggers for Backdoored Face Recognition Networks
• Improving Black-Box Generative Attacks via Generator Semantic Consistency
• Boosting Adversarial Attacks with Momentum
• CUBA: Controlled Untargeted Backdoor Attack against Deep Neural Networks
• Verification of Binarized Neural Networks via Inter-Neuron Factoring
• Boosting Adversarial Transferability via Commonality-Oriented Gradient Optimization
• Intriguing Frequency Interpretation of Adversarial Robustness for CNNs and ViTs
• A Neural Rejection System Against Universal Adversarial Perturbations in Radio Signal Classification
• X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP
• Robustness as Architecture: Designing IQA Models to Withstand Adversarial Perturbations
• Fool the Stoplight: Realistic Adversarial Patch Attacks on Traffic Light Detectors
• UPSET and ANGRI : Breaking High Performance Image Classifiers
• Adversarially Robust Neural Architectures
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• Contrastive Learning with Adversarial Examples
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Sparse Adversarial Perturbations for Videos
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• TRAP: Targeted Redirecting of Agentic Preferences
• Are classical deep neural networks weakly adversarially robust?
• Adversarially Robust AI-Generated Image Detection for Free: An Information Theoretic Perspective
• Novel Loss-Enhanced Universal Adversarial Patches for Sustainable Speaker Privacy
• On Machine Learning and Structure for Mobile Robots
• HeNet: A Deep Learning Approach on Intel^\circledR Processor Trace for Effective Exploit Detection
• BadNAVer: Exploring Jailbreak Attacks On Vision-and-Language Navigation
• Large Margin Deep Networks for Classification
• Diffusion-enabled Secure Semantic Communication Against Eavesdropping
• GAN-based Generator of Adversarial Attack on Intelligent End-to-End Autoencoder-based Communication System
• GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion
• JailbreaksOverTime: Detecting Jailbreak Attacks Under Distribution Shift
• When Efficiency Becomes Fragility: Exploiting Dynamic Routing Vulnerabilities in Adaptive UAV Tracking
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy
• Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approach
• Support is All You Need for Certified VAE Training
• Universal Concept Disruption for SAM3 Image Segmentation
• R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning
• PATFinger: Prompt-Adapted Transferable Fingerprinting against Unauthorized Multimodal Dataset Usage
• Tight Semidefinite Relaxations for Verifying Robustness of Neural Networks
• The Structural Safety Generalization Problem
• Adversarial Examples in Environment Perception for Automated Driving (Review)
• Security Risks in Vision-Based Beam Prediction: From Spatial Proxy Attacks to Feature Refinement

Discussions

• Universal adversarial perturbations [hn, 108 points, 46 comments]
• Defeating AI image recognition [lobsters, 10 points, 1 comments]
• Universal adversarial perturbations [lobsters, 4 points, 0 comments]
• Explainability reading 4: "Universal adversarial perturbations" https://arxiv.org/abs/1610.08401 Argues: There are small changes of inputs that can confuse classifiers on their entire support. Points [bsky, 1 points, 0 comments]

Related

• A Method for Computing Class-wise Universal Adversarial Perturbations
• Universal Adversarial Perturbations: A Survey
• Universal Adversarial Perturbations: Efficiency on a small image dataset
• Defending Against Universal Perturbations With Shared Adversarial Training
• Art of singular vectors and universal adversarial perturbations