Universal adversarial perturbations

Abstract

Given a state-of-the-art deep neural network classifier, we show the existence of a universal (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable to such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze these universal perturbations and show, in particular, that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important geometric correlations among the high-dimensional decision boundary of classifiers. It further outlines potential security breaches with the existence of single directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.

Accepted at IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017

References in corpus (10)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Deep Residual Learning for Image Recognition
• Caffe: Convolutional Architecture for Fast Feature Embedding
• Going Deeper with Convolutions
• Return of the Devil in the Details: Delving Deep into Convolutional Nets
• Learning with a Strong Adversary
• DeepFool: a simple and accurate method to fool deep neural networks
• Adversarial Manipulation of Deep Representations

Cited by in corpus (62)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Robust Physical-World Attacks on Deep Learning Models
• Deep Variational Information Bottleneck
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Sensitivity and Generalization in Neural Networks: an Empirical Study
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Testing Deep Neural Networks
• LaVAN: Localized and Visible Adversarial Noise
• Adversarial Examples, Uncertainty, and Transfer Testing Robustness in Gaussian Process Hybrid Deep Networks
• Adversarial Examples that Fool Detectors
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Understanding and Enhancing the Transferability of Adversarial Examples
• UPSET and ANGRI : Breaking High Performance Image Classifiers
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Contrastive Learning with Adversarial Examples
• A Survey of Game Theoretic Approaches for Adversarial Machine Learning in Cybersecurity Tasks
• Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• Boosting Adversarial Attacks with Momentum
• Defending Against Universal Attacks Through Selective Feature Regeneration
• SafetyNet: Detecting and Rejecting Adversarial Examples Robustly
• Adversarially Robust Neural Architectures
• Reachability Analysis of Deep Neural Networks with Provable Guarantees
• Confidence estimation in Deep Neural networks via density modelling
• Rethinking generalization requires revisiting old ideas: statistical mechanics approaches and complex learning behavior
• A Study and Comparison of Human and Deep Learning Recognition Performance Under Visual Distortions
• PeerNets: Exploiting Peer Wisdom Against Adversarial Attacks
• Sparse Adversarial Perturbations for Videos
• Art of singular vectors and universal adversarial perturbations
• On the Convergence of SGD with Biased Gradients
• Large Margin Deep Networks for Classification
• The gap between theory and practice in function approximation with deep neural networks
• Improving Network Robustness against Adversarial Attacks with Compact Convolution
• SafeAMC: Adversarial training for robust modulation recognition models
• LatentPoison - Adversarial Attacks On The Latent Space
• Identify Susceptible Locations in Medical Records via Adversarial Attacks on Deep Predictive Models
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• Deep saliency: What is learnt by a deep network about saliency?
• Semantics Preserving Adversarial Learning
• Verification of Binarized Neural Networks via Inter-Neuron Factoring
• There is no Artificial General Intelligence
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Machine vs Machine: Minimax-Optimal Defense Against Adversarial Examples
• HeNet: A Deep Learning Approach on Intel${}^{\circledR }$ Processor Trace for Effective Exploit Detection
• On Machine Learning and Structure for Mobile Robots
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy
• A Singular Value Perspective on Model Robustness
• Measurement-driven Security Analysis of Imperceptible Impersonation Attacks
• Deep Learning Seismic Substructure Detection using the Frozen Gaussian Approximation
• Towards an Understanding of Neural Networks in Natural-Image Spaces
• Butterfly Effect: Bidirectional Control of Classification Performance by Small Additive Perturbation
• Reinforcement Learning for Autonomous Defence in Software-Defined Networking
• Adequacy of the Gradient-Descent Method for Classifier Evasion Attacks
• Benchmarking Popular Classification Models' Robustness to Random and Targeted Corruptions
• Adversarial Attacks with Time-Scale Representations
• P-CapsNets: a General Form of Convolutional Neural Networks
• Where Classification Fails, Interpretation Rises
• Strategies for Robust Image Classification
• A game-theoretic analysis of DoS attacks on driverless vehicles