On Distinctive Properties of Universal Perturbations

TL;DR

This paper explores the unique properties of universal adversarial perturbations, revealing their semantic locality, spatial invariance, and reduced reliance on non-robust features compared to standard adversarial attacks.

Contribution

It identifies key properties of UAPs that differentiate them from standard adversarial perturbations, including human-aligned semantic and spatial features.

Findings

Targeted UAPs exhibit semantic locality and spatial invariance.

UAPs contain less signal for generalization than standard adversarial perturbations.

UAPs leverage non-robust features to a smaller extent.

Abstract

We identify properties of universal adversarial perturbations (UAPs) that distinguish them from standard adversarial perturbations. Specifically, we show that targeted UAPs generated by projected gradient descent exhibit two human-aligned properties: semantic locality and spatial invariance, which standard targeted adversarial perturbations lack. We also demonstrate that UAPs contain significantly less signal for generalization than standard adversarial perturbations -- that is, UAPs leverage non-robust features to a smaller extent than standard adversarial perturbations.