[Paper Review] Generalizable Data-free Objective for Crafting Universal Adversarial Perturbations

Konda Reddy Mopuri, Aditya Ganeshan+1 more|arXiv (Cornell University)|Jan 24, 2018

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a data-free, generalizable objective for crafting universal adversarial perturbations (UAPs) that fool deep neural networks across multiple vision tasks without requiring access to training data. By exploiting the correlation between the perturbation's effect on input features and its impact on feature representations, the method achieves high fooling rates—up to 77.77% on ImageNet classification—using only simple priors like image mean and dynamic range.

ABSTRACT

Machine learning models are susceptible to adversarial perturbations: small changes to input that can cause large changes in output. It is also demonstrated that there exist input-agnostic perturbations, called universal adversarial perturbations, which can change the inference of target model on most of the data samples. However, existing methods to craft universal perturbations are (i) task specific, (ii) require samples from the training data distribution, and (iii) perform complex optimizations. Additionally, because of the data dependence, fooling ability of the crafted perturbations is proportional to the available training data. In this paper, we present a novel, generalizable and data-free approaches for crafting universal adversarial perturbations. Independent of the underlying task, our objective achieves fooling via corrupting the extracted features at multiple layers. Therefore, the proposed objective is generalizable to craft image-agnostic perturbations across multiple vision tasks such as object recognition, semantic segmentation, and depth estimation. In the practical setting of black-box attack scenario (when the attacker does not have access to the target model and it's training data), we show that our objective outperforms the data dependent objectives to fool the learned models. Further, via exploiting simple priors related to the data distribution, our objective remarkably boosts the fooling ability of the crafted perturbations. Significant fooling rates achieved by our objective emphasize that the current deep learning models are now at an increased risk, since our objective generalizes across multiple tasks without the requirement of training data for crafting the perturbations. To encourage reproducible research, we have released the codes for our proposed algorithm.

Motivation & Objective

• To address the limitations of existing universal adversarial perturbation (UAP) methods that rely on training data and perform poorly in black-box settings.
• To develop a generalizable objective that can craft effective UAPs across diverse computer vision tasks such as image classification, semantic segmentation, and depth estimation.
• To enable effective black-box attacks by eliminating dependency on target model training data while maintaining high fooling rates.
• To explore how minimal priors about data distribution (e.g., mean, dynamic range) can enhance perturbation strength without requiring actual data samples.
• To demonstrate that the proposed objective generalizes across models and tasks by leveraging feature-level correlations rather than local linearity assumptions.

Proposed method

• Proposes a data-free objective that maximizes the L2 norm of the feature representation change caused by the perturbation, i.e., ||f(x+δ)−f(x)||₂, without requiring access to training data.
• Exploits the strong correlation between ||f(x+δ)−f(x)||₂ and ||f(δ)||₂—where f is the feature extractor—rather than relying on local linearity of the network.
• Uses a simple optimization process to craft perturbations that maximize the relative shift in activations at the classification layer (fc₈), which correlates strongly with fooling rates.
• Incorporates minimal priors such as image mean and dynamic range to improve perturbation strength, even without real data.
• Applies the same objective across multiple tasks (classification, segmentation, depth estimation) using the same perturbation, demonstrating cross-task generalization.
• Employs a gradient-based optimization scheme to iteratively refine the universal perturbation, ensuring imperceptibility and high fooling performance.

Experimental results

Research questions

• RQ1 Can a data-free objective be designed to craft universal adversarial perturbations that generalize across multiple vision tasks without requiring training data?
• RQ2 How does the proposed objective compare to data-dependent methods in black-box attack scenarios where training data is unavailable?
• RQ3 To what extent can minimal priors about the data distribution (e.g., mean, range) improve the fooling capability of data-free UAPs?
• RQ4 Is the correlation between ||f(x+δ)−f(x)||₂ and ||f(δ)||₂ sufficient to guide effective perturbation crafting, even without assuming local linearity?
• RQ5 Can the same perturbation effectively fool diverse models across different tasks such as classification, segmentation, and depth estimation?

Key findings

• The proposed data-free objective achieves a fooling rate of 77.77% on ImageNet classification using only the full data prior, significantly outperforming data-dependent baselines in black-box settings.
• Even without any data, the method achieves a 45.47% fooling rate on ImageNet classification, demonstrating strong performance in the absence of training data.
• The inclusion of simple priors—such as image mean and dynamic range—increases the fooling rate from 45.47% (no prior) to 63.08% (range prior), and further to 77.77% with full data prior.
• The relative shift in feature activations at the classification layer (fc₈) is highly correlated with the actual fooling rate, validating the method’s design choice.
• The method generalizes across tasks: it successfully fools models for semantic segmentation (FCN-8s-VGG) and depth estimation (Monodepth-VGG), with failure cases observed only in complex scenes.
• The correlation between ||f(x+δ)−f(x)||₂ and ||f(δ)||₂ is strong and stable, confirming that the method effectively leverages feature-level dynamics rather than relying on local linearity.