Universal Adversarial Directions

TL;DR

This paper introduces Universal Adversarial Directions (UADs), a novel approach that improves the transferability of adversarial perturbations across different neural network architectures by fixing a universal direction and optimizing magnitude.

Contribution

The paper proposes UADs, providing a theoretical framework with Nash equilibrium analysis and an efficient PCA-based algorithm, enhancing transferability of adversarial attacks.

Findings

UADs have superior transferability compared to standard UAPs.

UADs can achieve a Nash equilibrium with a pure strategy.

Experimental results on benchmark datasets demonstrate UADs' effectiveness.

Abstract

Despite their great success in image recognition tasks, deep neural networks (DNNs) have been observed to be susceptible to universal adversarial perturbations (UAPs) which perturb all input samples with a single perturbation vector. However, UAPs often struggle in transferring across DNN architectures and lead to challenging optimization problems. In this work, we study the transferability of UAPs by analyzing equilibrium in the universal adversarial example game between the classifier and UAP adversary players. We show that under mild assumptions the universal adversarial example game lacks a pure Nash equilibrium, indicating UAPs' suboptimal transferability across DNN classifiers. To address this issue, we propose Universal Adversarial Directions (UADs) which only fix a universal direction for adversarial perturbations and allow the perturbations' magnitude to be chosen freely across samples. We prove that the UAD adversarial example game can possess a Nash equilibrium with a pure UAD strategy, implying the potential transferability of UADs. We also connect the UAD optimization problem to the well-known principal component analysis (PCA) and develop an efficient PCA-based algorithm for optimizing UADs. We evaluate UADs over multiple benchmark image datasets. Our numerical results show the superior transferability of UADs over standard gradient-based UAPs.