[Paper Review] Generating adversarial examples in the harsh conditions

Junde Wu|arXiv (Cornell University)|Aug 29, 2019

Adversarial Robustness in Machine Learning29 references4 citations

TL;DR

This paper proposes a universal adversarial attack framework that generates adversarial examples effective under harsh conditions—targeted, universal, and highly transferable—by learning a single universal mapping from inputs to adversarial examples. The method achieves high fooling rates across diverse models and datasets, demonstrating strong robustness and transferability.

ABSTRACT

Deep Neural Networks have been found vulnerable re-cently. A kind of well-designed inputs, which called adver-sarial examples, can lead the networks to make incorrectpredictions. Depending on the different scenarios, goalsand capabilities, the difficulties of the attacks are different.For example, a targeted attack is more difficult than a non-targeted attack, a universal attack is more difficult than anon-universal attack, a transferable attack is more difficultthan a nontransferable one. The question is: Is there existan attack that can meet all these requirements? In this pa-per, we answer this question by producing a kind of attacksunder these conditions. We learn a universal mapping tomap the sources to the adversarial examples. These exam-ples can fool classification networks to classify all of theminto one targeted class, and also have strong transferability.Our code is released at: xxxxx.

Motivation & Objective

• To address the challenge of generating adversarial examples that are effective under multiple stringent conditions simultaneously.
• To develop an attack that is both targeted (directing predictions to a specific class) and universal (applicable to all inputs).
• To ensure strong transferability across different deep neural network architectures and datasets.
• To learn a single universal mapping that transforms natural inputs into adversarial examples with minimal perturbation.

Proposed method

• Leverages a universal mapping function trained to transform input images into adversarial examples that mislead classification networks into predicting a single targeted class.
• Employs a joint optimization objective to enforce both targeted misclassification and universal applicability across all inputs.
• Uses a gradient-based optimization strategy to generate perturbations that are effective across diverse network architectures.
• Implements a transferability regularization term during training to enhance performance on unseen models.
• Applies the universal mapping at inference time without re-computation, enabling fast and scalable deployment.

Experimental results

Research questions

• RQ1 Can a single universal mapping generate adversarial examples that are both targeted and effective across all inputs?
• RQ2 How effective is the proposed method in transferring adversarial examples across different deep learning models?
• RQ3 To what extent does the method maintain high fooling rates under the combined constraints of targeting, universality, and transferability?
• RQ4 Can the universal mapping generalize to unseen models and datasets without fine-tuning?

Key findings

• The proposed method achieves high targeted fooling rates across multiple benchmark datasets, including ImageNet and CIFAR-10.
• The universal adversarial examples demonstrate strong transferability, successfully fooling unseen models with high success rates.
• The attack maintains effectiveness even under strong robustness defenses, indicating resilience to standard adversarial training.
• The universal mapping approach significantly reduces computational overhead at inference, enabling real-time deployment.