Simple iterative method for generating targeted universal adversarial perturbations

TL;DR

This paper introduces a straightforward iterative approach to create targeted universal adversarial perturbations that can reliably mislead deep neural networks into specific incorrect classifications, highlighting their vulnerability.

Contribution

It presents a novel simple iterative method combining existing techniques to generate targeted UAPs, addressing a gap in adversarial attack research.

Findings

Existence of almost imperceptible targeted UAPs for DNNs

Proposed method effectively generates targeted UAPs

Targeted UAPs are easily reproducible

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial attacks. In particular, a single perturbation known as the universal adversarial perturbation (UAP) can foil most classification tasks conducted by DNNs. Thus, different methods for generating UAPs are required to fully evaluate the vulnerability of DNNs. A realistic evaluation would be with cases that consider targeted attacks; wherein the generated UAP causes DNN to classify an input into a specific class. However, the development of UAPs for targeted attacks has largely fallen behind that of UAPs for non-targeted attacks. Therefore, we propose a simple iterative method to generate UAPs for targeted attacks. Our method combines the simple iterative method for generating non-targeted UAPs and the fast gradient sign method for generating a targeted adversarial perturbation for an input. We applied the proposed method to state-of-the-art DNN models for image classification and proved the existence of almost imperceptible UAPs for targeted attacks; further, we demonstrated that such UAPs are easily generatable.