Art of singular vectors and universal adversarial perturbations

Abstract

Vulnerability of Deep Neural Networks (DNNs) to adversarial attacks has been attracting a lot of attention in recent studies. It has been shown that for many state of the art DNNs performing image classification there exist universal adversarial perturbations --- image-agnostic perturbations mere addition of which to natural images with high probability leads to their misclassification. In this work we propose a new algorithm for constructing such universal perturbations. Our approach is based on computing the so-called $(p,q)$-singular vectors of the Jacobian matrices of hidden layers of a network. Resulting perturbations present interesting visual patterns, and by using only 64 images we were able to construct universal perturbations with more than 60 \% fooling rate on the dataset consisting of 50000 images. We also investigate a correlation between the maximal singular value of the Jacobian matrix and the fooling rate of the corresponding singular vector, and show that the constructed perturbations generalize across networks.

arXiv commentSubmitted to CVPR 2018

References in corpus (5)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Deep Residual Learning for Image Recognition
• Going Deeper with Convolutions
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Universal adversarial perturbations

Cited by in corpus (5)

• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Geometry-Inspired Top-k Adversarial Perturbations
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• Universal Physical Camouflage Attacks on Object Detectors