Simple iterative method for generating targeted universal adversarial perturbations
This addresses the vulnerability of DNNs to targeted adversarial attacks, providing a tool for more realistic security evaluations, though it is incremental as it builds on prior methods.
The paper tackles the problem of generating universal adversarial perturbations (UAPs) for targeted attacks on deep neural networks, proposing a simple iterative method that combines existing techniques to create almost imperceptible UAPs, as demonstrated on state-of-the-art image classification models.
Deep neural networks (DNNs) are vulnerable to adversarial attacks. In particular, a single perturbation known as the universal adversarial perturbation (UAP) can foil most classification tasks conducted by DNNs. Thus, different methods for generating UAPs are required to fully evaluate the vulnerability of DNNs. A realistic evaluation would be with cases that consider targeted attacks; wherein the generated UAP causes DNN to classify an input into a specific class. However, the development of UAPs for targeted attacks has largely fallen behind that of UAPs for non-targeted attacks. Therefore, we propose a simple iterative method to generate UAPs for targeted attacks. Our method combines the simple iterative method for generating non-targeted UAPs and the fast gradient sign method for generating a targeted adversarial perturbation for an input. We applied the proposed method to state-of-the-art DNN models for image classification and proved the existence of almost imperceptible UAPs for targeted attacks; further, we demonstrated that such UAPs are easily generatable.