Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations

1. Introduction

• The paper situates its analysis amid unresolved explanations of adversarial examples and a feature-extractor view of DNNs linked to non-robust dataset features.Prior work had explored the phenomenon, but the introduction notes a lack of consensus [1].Source: §1 · p. 1
• The analysis treats all DNN logits as a feature-representation vector and uses PCC between individual-input and combined-input logit vectors to assess their relative contributions.The framework is proposed for two independent inputs, including images, Gaussian noise, and perturbations.Source: §1 · pp. 1–2
• UAPs have dominant features in adversarial examples, while the attacked images behave like noise, according to the logit-vector and PCC analysis.The authors describe this as contrary to the view that perturbations are noise added to images.Source: §1 · p. 2
• Because images behave like noise to UAPs, proxy images can stand in for original training data when generating targeted UAPs.The authors note that attackers generally cannot access the training data [33].Source: §1 · p. 2
• The authors report the first targeted universal attack without original training data, with proxy-dataset performance comparable to state-of-the-art baselines using the original training dataset.The proposed method uses random source images as its proxy dataset.Source: §1 · p. 2

2. Related Work

• Explanations include local linearity [14], high-dimensional input properties [41] [10] [26] [13], and non-robust dataset features [17], but the review notes challenges to some accounts.Reported tensions include adversarial examples violating local linearity [25] and robust high-dimensional DNNs [25] [37].Source: §2 · p. 2
• For universal-attack vulnerability, earlier analyses link perturbations to decision-boundary curvature [28] [29], whereas this paper studies mutual influence through logit vectors.The authors say their framework does not rely on decision-boundary curvature [28] [29].Source: §2 · p. 2
• Attacks are categorized as image-dependent or universal, with universal attacks using one perturbation across images and posing a more challenging task.The review also distinguishes targeted from non-targeted attacks and describes targeted attacks as more challenging.Source: §2 · p. 2
• Prior data-free universal methods were non-targeted, and the review identifies targeted universal attack without original training data as an unmet task addressed by this work.The described data-free approach maximizes activation scores in every layer and performs worse than approaches using original training data [33].Source: §2 · p. 3

3.1. Logit Vector

• DNN outputs before softmax are treated as feature vectors, with each input’s logits compared against those for the summed input.The authors assume all output logits represent responses to input features, rather than considering only the highest logit.Source: §3.1 · p. 3

3.2. Pearson Correlation Coefficient

• PCC between each individual input’s logit vector and the combined vector indicates which input contributes more significantly to the combined feature representation.The authors compare PCC for each input against the combined input; a higher value indicates the more significant contributor.Source: §3.2 · p. 3
• For two randomly sampled ImageNet images, Lb and Lc show strong linear correlation (PCCLb,Lc = 0.88), while La and Lc are practically uncorrelated (PCCLa,Lc = 0.19), suggesting input b contributes dominantly to Lc.The same label “Wood rabbit” is predicted for c and b.Source: §3.2 · pp. 3–4
• 96% PPCC on image pairs whose combined prediction matches one input supports PCC’s reliability for inferring the predicted class; pairs matching neither show a smaller PCCh −PCCl gap.The study uses 1,000 randomly sampled ImageNet pairs; Table 1 reports means and standard deviations for higher and lower PCC values.Source: §3.2 · p. 4, Table 1 · p. 4
• The Figure 2 results are reported to support the importance of all logit values, rather than only the highest or semantically similar logits.The authors argue that the higher PCC for the dominant input also weighs against treating lower logits as random values.Source: §3.2 · p. 4

4. Influence of Images and Perturbations on Each Other

• Experiments analyze image–perturbation interactions on ImageNet-pretrained VGG19 using one randomly chosen image and, for targeted perturbations, the target class ‘sea lion’.The authors refer to supplementary material for results with other images, target classes, and networks.Source: §4 · p. 4

4.1. Analysis of Gaussian Noise

• With Gaussian noise σ = 0, PCCLa,Lc = 1; at σ = 0.1, PCCLa,Lc = 0.91, while Lb has low correlation with Lc for all tested noise inputs.The analysis uses zero-mean Gaussian noise.Source: §4.1 · p. 4, Figure 3 · p. 4

4.2. Analysis of Universal Perturbations

• Targeted UAP features dominate the combined logits; non-targeted UAPs also dominate, but less strongly.For targeted UAPs, the clean-image features are described as seemingly unrecognizable to the DNN.Source: Figure 4 · p. 4, §4.2 · p. 5, Figure 5 · p. 5

4.3. Analysis of Image-Dependent Perturbations

• Image-dependent perturbations are weakly correlated with the combined logits and noise-like, even though image features remain more dominant and the image is misclassified.These perturbations are crafted to form concrete features only in combination with the image, violating the independent-input assumption.Source: §4.3 · p. 5, Figure 6 · p. 5, Figure 7 · p. 5

4.4. Why Do Adversarial Perturbations Exist?

• Universal perturbations contain features independent of the images they attack, while image features become unrecognizable to the DNN and behave like noise.This account differs from Jetley et al.’s decision-boundary explanation: it focuses on strong features robust to image influence and permits using PGD to generate target-class features.Source: §4.4 · p. 5

5. Targeted UAP with Proxy Data

• Proxy images serve as background noise and need not contain objects from the original training classes; their role is to support strong, background-robust target-class features.Source: §5 · p. 6

5.1. Problem Definition

• The objective is one perturbation vector that makes most images from distribution X predict target t, subject to a magnitude bound; evaluation uses targeted and non-targeted fooling ratios.The paper sets p = ∞ and ε = 10 for images in the range [0, 255].Source: §5.1 · p. 6

5.2. Loss Function and Algorithm

• The proposed method uses a target-focused loss with clamped logits; its CL2 variant generally outperforms the other discussed loss functions.The non-targeted UAP special case requires the original training dataset as its proxy dataset.Source: §5.2 · p. 6

5.3. Main Results

• Proxy datasets MS-COCO, Pascal VOC, and Places365 show no significant performance differences, and only a marginal gap from ImageNet training data.Results average eight target scenarios on the ImageNet test dataset.Source: §5.3 · p. 7, Table 3 · p. 7
• White images and Gaussian noise as proxy data produce inferior performance.The paper refers readers to supplementary material for possible reasons and further results.Source: §5.3 · p. 7

5.4. Comparison with Previous Methods

• 53.4% targeted fooling ratio on Inception-V3 with COCO exceeds [36]’s 52% using ImageNet training data.The paper describes this as the first targeted UAP without original training data.Source: §5.4 · pp. 7–8
• On the non-targeted fooling-ratio evaluation, the COCO-based method is comparable to state-of-the-art data-free methods, although the generated perturbation remains targeted and results average eight target classes.The paper notes this evaluation setting favors competing methods.Source: Table 4 · p. 7, §5.4 · p. 8

5.5. Transferability

• Non-targeted transferability performs reasonably well, whereas targeted transferability does not; VGG16 and VGG19 transfer reasonably well between each other.PCC values are relatively higher between VGG16 and VGG19 than between other networks.Source: Table 5 · p. 7, Table 6 · p. 7, §5.5 · p. 8

• Logit vectors and PCC are used to analyze how two independent inputs contribute to a combined feature representation.Source: §6 · p. 8
• The analysis finds that universal perturbations have dominant features and that attacked images behave like noise to them.Source: §6 · p. 8
• This insight motivates a loss-designed method for targeted UAPs using proxy data, with performance comparable to state-of-the-art baselines that use original training data.The paper claims this is the first achievement of targeted UAP generation without original training data.Source: §6 · p. 8