Universal adversarial perturbations

Summary

The authors propose a systematic algorithm for computing universal perturbations to fool image classification networks. The perturbations are shown to work very well across neural networks.

The proposed algorithm has two parameters:

1. The norm of the perturbation to be added to images
2. The desired fooling rate

The idea is to iteratively go over images and build the “universal perturbation” $v$ by computing the minimal modification to $v$ that causes each image to be misclassified.

Experiments and Results

Dataset: ILSVRC 2012 validation set (50,000 images)

Note that in Table 1, “X” is the training set on which the universal perturbation is computed.