A Method for Computing Class-wise Universal Adversarial Perturbations
arXiv:1912.00466
Abstract
We present an algorithm for computing class-specific universal adversarial perturbations for deep neural networks. Such perturbations can induce misclassification in a large fraction of images of a specific class. Unlike previous methods that use iterative optimization for computing a universal perturbation, the proposed method employs a perturbation that is a linear function of weights of the neural network and hence can be computed much faster. The method does not require any training data and has no hyper-parameters. The attack obtains 34% to 51% fooling rate on state-of-the-art deep neural networks on ImageNet and transfers across models. We also study the characteristics of the decision boundaries learned by standard and adversarially trained models to understand the universal adversarial perturbations.
References in corpus (11)
- Caffe: Convolutional Architecture for Fast Feature Embedding
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Certified Defenses against Adversarial Examples
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Robustness May Be at Odds with Accuracy
- Black-box Adversarial Attacks with Limited Queries and Information
- Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
- Fast Feature Fool: A data independent approach to universal adversarial perturbations
- Provably Minimally-Distorted Adversarial Examples
- Evaluating and Understanding the Robustness of Adversarial Logit Pairing
- Exploring the Space of Black-box Attacks on Deep Neural Networks