Sigma-UAP: An Invisible Semi-Universal Adversarial Attack Against Deep Neural Networks

Abstract

Although deep neural networks (DNNs) have achieved exceptional performance, they are shown to be fragile to universal adversarial perturbations (UAP), which can be applied to any images to fool a well-trained DNN. Several methods have been proposed to design universal perturbations. However, these methods often leave visible traces in natural images. In this paper, we propose Sigma-UAP, a semi-universal adversarial attack, to enhance the quasi-imperceptibility of universal adversarial perturbations, in which the Sigma-map algorithm is leveraged to hide perturbations by identifying the low-frequency region of the image and eliminating the perturbations in that region. Then, we use a simple matrix calculation to augment the perturbation in the high-frequency region to ensure the attack effectiveness of the perturbation. The extensive empirical experiments show that, compared with the state-of-the-art universal adversarial attacks, Sigma-UAP method obtains excellent attack capabilities in visual effect and attack success rate.