Generate universal adversarial perturbations by shortest-distance soft maximum direction attack

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial attacks. Compared to the instance-specific adversarial examples, Universal Adversarial Perturbation (UAP) can fool the target model of different inputs with only one perturbation. However, previous UAP generation algorithms do not consider the shortest distance to the decision boundary of the Last Linear Operator (LLO), which hampers the UAP’s attackability under a limited perturbation size. In this paper, the LLO is analyzed to obtain several properties based on which the decision space of the LLO is modeled. Then, the UAP generation algorithm for the shortest-distance attack based on LLO is proposed. Moreover, we propose the maximum direction attack and combine it with the shortest-distance attack to obtain the shortest-distance soft maximum attack, which improves the transferability of UAP. To validate the performance of the algorithm proposed in this paper, we conduct UAP white-box and black-box attack experiments using the ImageNet dataset, and the results show that the attack success rate exceeds the latest research results.