A Survey On Universal Adversarial Attack

1 Introduction

• A UAP is a single perturbation capable of fooling a DNN when added to most natural images [Moosavi-Dezfooli et al., 2017a].The survey distinguishes this image-agnostic phenomenon from image-dependent adversarial examples.Source: §1 · p. 1
• The survey focuses on recent universal attack advances, including attack and defense methods and explanations for why UAPs exist.It mainly treats UAPs in image classification unless otherwise specified.Source: §1 · p. 1
• The survey covers UAP basics, attack and defense methods, explanations of the phenomenon, key challenges, and applications beyond image classification.The challenges identified are data dependency, black-box attack capability, and class discrimination.Source: §1 · p. 1

2 A Short Primer on Image-Dependent Attack Methods

• Image-dependent attacks either minimize perturbation magnitude subject to misclassification or maximize attack success under a limited perturbation budget.The first group includes L-BFGS and C&W; FGSM, I-FGSM, and PGD belong to the second.Source: §2 · pp. 1–2
• DeepFool iteratively updates gradients at decision boundaries, choosing a minimum-magnitude perturbation orthogonal to the decision hyperplane.The survey describes this minimum-perturbation group as cumbersome and slow.Source: §2 · p. 2
• FGSM is simple and fast but less effective, while I-FGSM applies FGSM iteratively using only a fraction of the allowed noise per step.The iterative updates contribute to I-FGSM’s higher attack effect compared with FGSM.Source: §2 · p. 2
• PGD differs from I-FGSM by initializing perturbations with random rather than zero values, which can improve success when iterations are limited or across multiple trials.Source: §2 · p. 2

3.1 Definition of UAPs in Deep Image Classifiers

• A UAP is one perturbation ν that changes a classifier’s prediction for most images drawn from distribution µ, subject to an lp-norm bound ||ν||p ≤ ϵ.A common choice is p = ∞ and ϵ = 10/255 for images in [0, 1] [Moosavi-Dezfooli et al., 2017a; Poursaeed et al., 2018; Zhang et al., 2020b].Source: §3.1 · p. 2

3.2 Metrics to Evaluate the UAP Effectiveness

• Fooling ratio measures the percentage of samples whose predictions change after a UAP; targeted fooling ratio measures the percentage classified as a predefined target class.Source: §3.2 · p. 2

3.3 Universal Attack Methods

• The vanilla method accumulates image-dependent minimal perturbations, projecting onto the lp ball after each update until a fooling-rate threshold is reached.The survey also describes singular-vector methods, generative networks, and feature-based optimization approaches for generating UAPs.Source: §3.3 · pp. 2–3
• Directly optimizing the perturbation can avoid training a separate generative network and achieve superior performance, while generative approaches ease the vanilla method’s slow procedure but require a generator.The survey reports that Dai and Shu’s orientation-based update increased fooling rate by 9% over vanilla UAP; Table 1 compares fooling ratios for white-box methods, separating original-ImageNet-data and data-free approaches.Source: §3.3 · p. 3, Table 1 · p. 3

3.4 Defending Against UAP

• UAP defenses include adversarial training, feature-level methods, and rectification or detection, but training can be costly because UAP generation takes many iterations.Shared adversarial training is reported to use 20 times more computation than normal training; universal adversarial training concurrently updates the network and perturbation.Source: §3.4 · p. 3

• Existing explanations based on local linearity, high dimensionality, over-fitting, and noise disturbance mainly address image-dependent perturbations, leaving UAP explanations at an early stage.The survey groups UAP explanations into geometric and feature perspectives.Source: §4 · pp. 3–4
• Geometric accounts attribute UAPs to a low-dimensional subspace containing perturbations roughly normal to decision boundaries across many images.Further analysis favors positively curved over flat decision boundaries as an explanation.Source: §4 · p. 4
• Feature-based analysis finds that UAPs can carry human-aligned semantic features and dominate images in model predictions, with images behaving like noise to the perturbations.The survey also reports high-frequency sensitivity as a factor in UAP and universal deep-hiding success.Source: §4 · p. 4

5 Challenges of UAP Attack

• UAPs can misclassify samples across all classes, which may attract attention; class-discriminative attacks aim to limit effects to selected classes for greater stealth.The survey identifies data dependence and lack of target-model access as additional practical challenges.Source: §5 · p. 4

5.1 Data-Free UAPs

• Data-free methods replace training images with activation-maximizing objectives, class impressions, proxy datasets, or jigsaw images when crafting UAPs.GD-UAP is reported to generalize across image recognition, segmentation, and depth estimation.Source: §5.1 · pp. 4–5

5.2 Black-Box UAPs

• Black-box UAP research includes transfer-based methods and DUAttack, which uses target hard-label feedback and momentum to guide perturbation updates while reducing queries.Targeted black-box UAPs are described as rarer and more challenging; targeted fooling ratios are relatively low for most networks but higher within architecture families.Source: §5.2 · p. 5

5.3 Class-Discriminative UAPs (CD-UAPs)

• Class-discriminative UAPs combine separate losses for targeted and non-targeted samples, while Double Targeted Attack directs samples from a chosen class toward a predefined target class.Other work explores data-independent class-wise UAPs by exploiting decision-boundary linearity.Source: §5.3 · p. 5

6 Universal Attack Beyond Classification

• Video work includes a UAP for video recognition and an attack that appends multiple dummy frames to arbitrary clips.Source: §6 · pp. 5–6

6.1 Beyond Classification in the Image Domain

• Beyond classification in images, UAP methods target segmentation, depth estimation, and image retrieval, including a black-box distillation strategy reported to extend to Google Images.Segmentation attacks can target a desired map or remove selected classes while leaving other regions unchanged.Source: §6.1 · p. 6

6.2 Text Classification

• Text attacks use universal token sequences or embedding-space perturbations; adversarially regularized autoencoders can generate natural English phrases to address the detectability of non-semantic sequences.Source: §6.2 · p. 6

6.3 Audio Classification

• Audio UAPs target tasks such as speech commands, and generative perturbation methods include room simulation to estimate sound distortions and improve performance.The survey reports efficacy on a public dataset of 109 speakers and notes the influence of image-domain algorithms on audio research.Source: §6.3 · p. 6

• The survey covers UAP progress in attack and defense, explanations of UAP existence, and challenges including data dependence, black-box attacks, and class discrimination.Source: §7 · p. 6
• The survey also summarizes universal attacks across applications beyond image classification.Source: §7 · p. 6
• The authors describe UAP research as fast-evolving and propose joint investigation with data hiding as a future direction.Source: §7 · p. 6