[Paper Review] Label Universal Targeted Attack

Naveed Akhtar, Mohammad A. A. K. Jalwana+2 more|arXiv (Cornell University)|May 27, 2019

Advanced Malware Detection Techniques20 references4 citations

TL;DR

This paper introduces Label Universal Targeted Attack (LUTA), a white-box adversarial attack that generates universal perturbations to force a deep neural network to misclassify any image from a source class into a user-defined target class with high probability. By optimizing perturbations using first- and second-order gradient moments, LUTA achieves high fooling rates on ImageNet and VGGFace models and demonstrates strong transferability to physical-world settings.

ABSTRACT

We introduce Label Universal Targeted Attack (LUTA) that makes a deep model predict a label of attacker's choice for `any' sample of a given source class with high probability. Our attack stochastically maximizes the log-probability of the target label for the source class with first order gradient optimization, while accounting for the gradient moments. It also suppresses the leakage of attack information to the non-source classes for avoiding the attack suspicions. The perturbations resulting from our attack achieve high fooling ratios on the large-scale ImageNet and VGGFace models, and transfer well to the Physical World. Given full control over the perturbation scope in LUTA, we also demonstrate it as a tool for deep model autopsy. The proposed attack reveals interesting perturbation patterns and observations regarding the deep models.

Motivation & Objective

• To develop a novel adversarial attack that enables universal, targeted misclassification of an entire source class into a chosen target label.
• To provide fine-grained control over perturbation scope by targeting specific source and target class pairs, enhancing practical attack feasibility.
• To minimize detection risk by suppressing unintended misclassifications on non-source classes, preserving stealthiness.
• To explore deep model internals by using the attack as a tool for model autopsy, revealing insights into learned classification boundaries.
• To demonstrate transferability of LUTA perturbations to real-world physical deployments, validating practical threat.

Proposed method

• LUTA formulates a stochastic gradient-based optimization to maximize the log-probability of the target class for all images in the source class.
• It uses adaptive optimization via first and second moments of gradients (similar to Adam) to efficiently learn perturbations.
• The attack constrains perturbations within ℓ∞ or ℓ2 norms for controlled, imperceptible perturbations, or allows unbounded exploration for model analysis.
• Non-source class predictions are actively suppressed during optimization to avoid detection and maintain stealth.
• The method operates under a white-box setting, leveraging full access to the model’s gradients and architecture.
• Three variants are evaluated: ℓ∞-bounded, ℓ2-bounded, and unbounded LUTA, with the latter used for probing model decision regions.

Experimental results

Research questions

• RQ1 Can a universal adversarial perturbation be constructed to universally misclassify all images of a given source class into a specific target class?
• RQ2 How effective is the attack in maintaining high fooling rates across diverse deep learning models like VGG-16, ResNet-50, and Inception-V3 on ImageNet?
• RQ3 To what extent do LUTA perturbations transfer to physical-world deployments without digital enhancement?
• RQ4 What insights into the internal decision boundaries of deep models can be revealed by analyzing the perturbation patterns generated via LUTA?
• RQ5 Can the use of gradient moments (first and second) significantly improve the efficiency and convergence of the attack?

Key findings

• LUTA achieves a fooling ratio of 99% on ImageNet models such as VGG-16, ResNet-50, Inception-V3, and MobileNet-V2 under ℓ∞ and ℓ2 constraints.
• The unbounded LUTA variant reveals distinct perturbation patterns that trace migration paths across semantically related classes, such as from 'car' to 'bus' via intermediate transportation classes.
• Physical-world experiments show that LUTA perturbations remain effective when printed and viewed via live webcam, demonstrating strong transferability without post-processing.
• The use of gradient moments (first and second) significantly improves optimization efficiency, reducing the number of iterations needed to achieve high fooling rates.
• The attack successfully suppresses misclassification on non-source classes, minimizing detection risk and maintaining stealth during deployment.
• LUTA enables model autopsy by visualizing how entire class regions are manipulated, revealing geometric and semantic structures in deep model decision boundaries.