CD-UAP: Class Discriminative Universal Adversarial Perturbation
This work addresses a practical need in adversarial machine learning by enabling attackers to flexibly control targeted classes, representing an incremental improvement over existing UAP methods.
The authors tackled the problem of generating universal adversarial perturbations (UAPs) that selectively target specific classes while minimizing impact on others, proposing CD-UAP, which achieved state-of-the-art performance in both selective and all-class attacks across benchmark datasets.
A single universal adversarial perturbation (UAP) can be added to all natural images to change most of their predicted class labels. It is of high practical relevance for an attacker to have flexible control over the targeted classes to be attacked, however, the existing UAP method attacks samples from all classes. In this work, we propose a new universal attack method to generate a single perturbation that fools a target network to misclassify only a chosen group of classes, while having limited influence on the remaining classes. Since the proposed attack generates a universal adversarial perturbation that is discriminative to targeted and non-targeted classes, we term it class discriminative universal adversarial perturbation (CD-UAP). We propose one simple yet effective algorithm framework, under which we design and compare various loss function configurations tailored for the class discriminative universal attack. The proposed approach has been evaluated with extensive experiments on various benchmark datasets. Additionally, our proposed approach achieves state-of-the-art performance for the original task of UAP attacking all classes, which demonstrates the effectiveness of our approach.