Generalizable Data-free Objective for Crafting Universal Adversarial Perturbations

Konda Reddy Mopuri; Aditya Ganeshan; R. Venkatesh Babu

Source-linked AI summary

Generalizable Data-free Objective for Crafting Universal Adversarial Perturbations

Konda Reddy Mopuri, Aditya Ganeshan, R. Venkatesh Babu

arXiv:1801.08092v3Jan 24, 2018cs.CVcs.AIcs.LG

TL;DR

Existing universal adversarial perturbation methods are task-specific and data-dependent, limiting their use when target data or models are unavailable. The paper proposes GD-UAP, which corrupts learned features at multiple layers to craft data-free, image-agnostic perturbations across vision tasks. It reports generalization across architectures and tasks, significant black-box transfer, and stronger perturbations when minimal data-distribution priors are supplied.

Problem
Existing UAP objectives are task-specific, require training data, and are limited in black-box settings where target models and large training datasets are unavailable.
Method
GD-UAP optimizes data-free perturbations by over-firing neuron activations at multiple layers, thereby corrupting learned feature representations.
Results
GD-UAP generalizes across multiple CNN architectures and diverse vision tasks, achieves significant transfer performance for black-box attacks, and becomes stronger with minimal data priors.
Takeaways & Limitations
A generalizable objective for image-agnostic perturbations raises deployment concerns because it can target learned vision systems across tasks without training data.
Takeaways & Limitations
Existing data-dependent UAP procedures require enough training data to converge, and their fooling performance is proportional to the available data.

Abstract

from arXiv · show

Machine learning models are susceptible to adversarial perturbations: small changes to input that can cause large changes in output. It is also demonstrated that there exist input-agnostic perturbations, called universal adversarial perturbations, which can change the inference of target model on most of the data samples. However, existing methods to craft universal perturbations are (i) task specific, (ii) require samples from the training data distribution, and (iii) perform complex optimizations. Additionally, because of the data dependence, fooling ability of the crafted perturbations is proportional to the available training data. In this paper, we present a novel, generalizable and data-free approaches for crafting universal adversarial perturbations. Independent of the underlying task, our objective achieves fooling via corrupting the extracted features at multiple layers. Therefore, the proposed objective is generalizable to craft image-agnostic perturbations across multiple vision tasks such as object recognition, semantic segmentation, and depth estimation. In the practical setting of black-box attack scenario (when the attacker does not have access to the target model and it's training data), we show that our objective outperforms the data dependent objectives to fool the learned models. Further, via exploiting simple priors related to the data distribution, our objective remarkably boosts the fooling ability of the crafted perturbations. Significant fooling rates achieved by our objective emphasize that the current deep learning models are now at an increased risk, since our objective generalizes across multiple tasks without the requirement of training data for crafting the perturbations. To encourage reproducible research, we have released the codes for our proposed algorithm.

1 INTRODUCTION

The paper introduces GD-UAP, a data-free and task-independent objective for crafting image-agnostic universal adversarial perturbations. It targets learned features across multiple layers and evaluates generalization, black-box transfer, data priors, and defenses.

Motivation: Adversarial perturbations can threaten deployment because neural networks remain vulnerable even when attacks are realized in the physical world.The paper highlights safety concerns for critical applications such as autonomous driving.
Motivation: Existing UAP methods are limited by data dependency, weaker black-box performance, and task-specific objectives.They require training samples, may perform substantially worse in black-box settings, and are difficult to extend to regression tasks.
Proposed contribution: GD-UAP crafts universal perturbations without data-distribution knowledge by corrupting feature representations at multiple layers.It over-fires neurons during optimization, causing misfired activations and contaminated representations during inference.
Evaluation: GD-UAP is evaluated across three vision tasks covering both classification and regression.The paper presents the objective as generalizable beyond a single task and reports extensive evaluation across multiple vision settings.
Evaluation: The study compares GD-UAP with data-dependent counterparts and evaluates perturbation strength against various defense mechanisms.The analysis includes input transformations, targeted defenses, and robust architectural designs.

2 RELATED WORKS

Prior work established transferable universal perturbations, but existing objectives remained data-dependent and tailored to particular vision tasks. GD-UAP instead introduces a data-free, generic feature-disruption objective intended to transfer across architectures and tasks.

Adversarial perturbations: Adversarial behavior has been observed across recognition, segmentation, detection, pose estimation, and reinforcement-learning models.This broader vulnerability motivates studying attacks beyond image classification.
Transferability: Perturbations crafted for one model can fool models with different architectures and training sets, enabling black-box attack scenarios.Black-box attacks assume no information about the target model and its training data.
Prior UAP methods: Earlier universal perturbation methods can fool models over multiple images but optimize task-specific objectives and require training data.These limitations apply to prior classification and segmentation approaches.
GD-UAP: GD-UAP uses over-fired neuron activations as a generic notion of fooling across vision models despite architectural and task differences.The proposed objective crafts perturbations without any data samples.

3 PROPOSED APPROACH

The approach defines image distributions, CNN mappings, and image-agnostic perturbations, then learns task-specific perturbations in a data-free setting. These perturbations are intended to generalize across models performing the same or related vision task.

Notation: X denotes the image distribution in R^d, f the CNN mapping from image x to output f(x), and δ the learned image-agnostic perturbation in R^d.The notation establishes the input distribution, target network function, and perturbation used throughout the paper.
Task generality: Although the objective is task independent, the paper explains it using object recognition while targeting task-specific perturbations across vision tasks.The same approach is presented as applicable to multiple vision tasks.
Generalization: The crafted task-specific perturbations are described as cross-model generalizable and learned without data samples.Figure 1 summarizes the data-free construction for a task-specific target CNN.

3.1 Data-free objective for fooling

The paper crafts image-agnostic perturbations without target-distribution samples by maximizing spurious activations across multiple CNN layers under an imperceptibility constraint.

Data-free objective: The objective seeks a perturbation δ that fools a CNN on target-distribution images without using samples from that distribution.The perturbation is constrained by a max-norm limit ξ.
Feature corruption: Because data-free optimization cannot use input-dependent label objectives, it contaminates representations by over-firing features at multiple layers.The perturbation causes filters to fire spuriously and extract ineffective information.
Optimization: Starting from a random perturbation, the method optimizes for maximal spurious activations at each selected layer.The optimization updates δ to produce strong activations while respecting the perturbation bound.
Optimization: The loss multiplies activation magnitudes across layers and applies a logarithm, which the authors report produces stronger perturbations than summation.The objective is open-ended and seeks stronger disturbance across layers within the imperceptibility constraint.

3.2 Implementation Details

GD-UAP optimizes only a perturbation against a frozen target CNN, focusing on convolutional representations and validating fooling performance on unrelated images.

Optimization setup: The method begins with a trained CNN whose parameters remain frozen and a random perturbation that is optimized for strong activations at multiple layers.Only δ is updated during optimization.
Layer selection: Optimization is performed at convolutional layers because they learn information-extracting features later classified by fully connected layers.This choice was empirically more effective than optimizing at all layers.
Layer selection: For GoogLeNet and ResNet, the method optimizes the last layers of inception or residual blocks and independent convolutional layers.The resulting fooling capacity was observed to be similar to optimizing all intermediate layers.
Validation: The perturbation is updated iteratively using loss gradients until fooling performance saturates on a validation set composed from an unrelated substitute dataset.No image data is involved in the optimization itself.

3.3 Exploiting additional priors

GD-UAP can incorporate simple distribution priors, including input statistics or target samples, to optimize perturbations closer to the target data distribution and improve fooling ability.

Additional priors: The approach can exploit the input mean and dynamic range, or target data samples, as additional priors about the distribution X.These extensions supplement the data-free objective rather than changing its feature-overfiring strategy.
Mean and dynamic range: Without distribution information, optimization inputs have range [−ξ, ξ], whereas inference inputs lie in [0, 255], making neuron activation effects difficult to learn.The paper highlights the resulting mismatch between optimization and inference signals.
Mean and dynamic range: Gaussian pseudo-data act as placeholders for actual inputs by moving optimization into a subspace closer to the target distribution.This helps learn perturbations that over-fire activations in the presence of actual data.
Target data samples: When samples are available, the optimization uses a subset of training images on which the target CNN models were trained.This is presented as a natural extension of providing the target data’s dynamic range alone.

3.4 Improved Optimization

The improved optimization addresses perturbation saturation by rescaling δ, replacing fixed-interval rescaling with an adaptive rule based on saturated pixels.

Saturation handling: The objective can push δ beyond the max-norm bound, making post-iteration clipping render later updates futile.The method therefore rescales δ to half its dynamic range, [−5, 5].
Adaptive rescaling: The improved method adaptively rescales δ using the proportion of pixels that reach the max-norm limits ±10.As saturation increases, the rate of increase in that proportion decreases.

3.5 Algorithmic summarization

Algorithm 1 summarizes the proposed procedure for crafting image-agnostic adversarial perturbations, covering data-free and prior-based variants. It combines iterative optimization with notation for fooling, activations, gradients, saturation, and convergence validation.

Algorithm 1 presents the proposed optimization as a sequence of steps for crafting image-agnostic adversarial perturbations.
The generic algorithm covers three variants: data-free, prior-based, and training-data-based perturbation crafting.
The notation includes fooling rate, layer activations, learning rate, input gradients, pixel saturation, saturation threshold, and validation patience.

3.6 Generalized Fooling Rate (GFR)

Generalized Fooling Rate (GFR) measures perturbation-induced changes in model output using task-specific performance metrics. This makes fooling interpretable across tasks and accommodates settings where different metrics capture different kinds of damage.

GFR measures perturbation damage through the change in model output relative to a chosen performance metric, rather than ground-truth accuracy alone.It is defined for a metric M with range [0, R], comparing predictions before and after perturbation.
GFR extends the image-recognition fooling rate to tasks whose notion of fooling is otherwise unclear.
GFR supports task-specific evaluation by allowing the perturbation's damage to be measured with any relevant metric.
For image recognition, the formulation reduces to GFR(Top1) = 1 − Top1(ŷδ, ŷ), using Top-1 Accuracy.
For depth estimation, GFR can distinguish perturbations that harm some performance metrics while leaving others unaffected.
The reported algorithm applies GFR with respect to a selected metric for every task considered.

4 GD-UAP: EFFECTIVENESS ACROSS TASKS

GD-UAP is evaluated across recognition, semantic segmentation, and monocular depth estimation, showing data-free and prior-enhanced universal perturbations can affect classification and regression models. Fooling remains substantial across white-box and black-box recognition settings, while its measured impact depends on the task metric.

Cross-task evaluation: GD-UAP is evaluated on object recognition, semantic segmentation, and unsupervised monocular depth estimation across classification and regression settings.The experiments cover multiple architectures and learning setups.
Object recognition: 69.24% mean white-box fooling and 45.13% mean black-box fooling are achieved for recognition models using the range prior.White-box rates use target-model information, whereas off-diagonal black-box rates attack models without revealing the attacked model.
Object recognition: The proposed perturbations can be visually indistinguishable from clean images while producing different predictions on recognition models.The examples include model-specific perturbations and sample VGG-19 adversarial image pairs.
Prior information: A range prior boosts fooling rates by an average absolute 10% while remaining data-free, whereas supplying data produces an absolute 22% increase.With data, GD-UAP becomes comparable to or better than UAP for all models except ResNet-152.
Semantic segmentation: In semantic segmentation, fooling performance generally increases with added data priors, and “data w/ less BG” performs best for all models except DL-RN101.The less-background prior addresses the strong background-pixel imbalance in Pascal VOC-2012 training data.
Semantic segmentation: The proposed objective significantly fools segmentation models within the same perturbation range, whereas the random baseline is ineffective.The study reports this comparison using mean IOU on perturbed and clean images.
Depth estimation: For monocular depth estimation, range-prior perturbations reduce δ < 1.25 accuracy by 25.7% on average across two model variants.Different priors affect depth metrics differently: PRP harms threshold metrics more, while PDP can produce larger overall errors on selected metrics.
Metric interpretation: GFR(m) is introduced because a perturbation’s fooling performance varies by metric, making single-metric conclusions only partial.The depth experiments distinguish pixel-threshold metrics from overall-error metrics.

5 GD-UAP: ANALYSIS AND DISCUSSION

The analysis compares GD-UAP with existing data-dependent objectives, evaluates robustness and transfer, and examines why feature-activation optimization fools models across tasks.

GD-UAP maximizes activation energy, while the prior data-free objective maximizes mean activations; the improved objective consistently outperforms it by 3.18%.The comparison uses CaffeNet, VGG, and ResNet models, with similar behavior reported across other vision tasks.
Data-dependent objectives require target-distribution samples: arbitrary data causes significantly inferior fooling, whereas GD-UAP’s performance does not decrease without target data.The experiments compare Places-205 and ILSVRC data for crafting and evaluation, while proposed-method rates use no data with a range prior.
UAP fooling performance significantly decreases as the available optimization samples shrink, confirming dependence on training-data quantity.Figure 8 evaluates UAP perturbations crafted for multiple ILSVRC recognition models with varying sample sizes.
On GoogLeNet, UAP with a range prior achieves a 10.56 fooling rate versus 71.44 for GD-UAP, while actual data yields 78.5 for UAP versus 83.54 for GD-UAP.These results show that UAP benefits strongly from corresponding data samples, whereas GD-UAP remains effective with priors or no samples.
Defenses reduce UAP fooling but can damage clean-image accuracy; PRN defends against UAP yet performs poorly against the proposed data-prior perturbation.PRN’s limited coverage reflects training on UAPs generated only by UAP, while simple input transformations outperform it.
Hybrid networks reduce fooling rates by 13% on average relative to other models but remain vulnerable to black-box attacks.The comparison covers Hybrid-network, ResNet-18, and VGG-13.
Relative feature-activation change increases monotonically in deeper layers, and GD-UAP exploits correlation between ||f(x + δ) − f(x)||2 and ||f(δ)||2.The analysis rejects approximate local linearity while identifying correlation between these quantities as the basis of the data-free optimization.

6 CONCLUSION

The paper proposes a data-free objective for image-agnostic universal perturbations and shows that it generalizes across architectures and vision tasks. Minimal data-distribution priors can strengthen the perturbations, while their transfer performance raises black-box security concerns.

GD-UAP crafts image-agnostic universal perturbations that generalize across multiple CNN architectures and diverse computer-vision tasks.The objective injects maximal adversarial energy into learned representations subject to an imperceptibility constraint and fools classification and regression models.
Minimal priors such as image mean and dynamic range produce stronger perturbations, although the objective remains data-free in nature.The paper states that using data can further strengthen the crafted perturbations.
Generalizable objectives for image-agnostic perturbations create concerns for deploying reliable machine-learning-based vision systems.The conclusion frames task-independent objectives as a critical concern for model deployment.