Universal Adversarial Training

Understand

Standard adversarial attacks change the predicted class label of a selected image by adding specially tailored small perturbations to its pixels.

• In contrast, a universal perturbation is an update that can be added to any image in a broad class of images, while still changing the predicted class label.
• We study the efficient generation of universal adversarial perturbations, and also efficient methods for hardening networks to these attacks.
• We propose a simple optimization-based universal attack that reduces the top-1 accuracy of various network architectures on ImageNet to less than 20%, while learning the universal perturbation 13X faster than the standard method.