HackerPapers

arXiv:1610.08401cs.CV

Universal adversarial perturbations

Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, Pascal Frossard

Abstract

Given a state-of-the-art deep neural network classifier, we show the existence of a universal (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable to such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze these universal perturbations and show, in particular, that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important geometric correlations among the high-dimensional decision boundary of classifiers. It further outlines potential security breaches with the existence of single directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.

arXiv comments
Accepted at IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017
Journal reference
DOI
Subjects
cs.CVComputer Vision and Pattern Recognition cs.AIArtificial Intelligence cs.LGMachine Learning stat.MLMachine Learning (Statistics)

On Hacker News

Linked by 7 identifiable commenters in 8 comments across 8 threads, from Nov 2016 to Nov 2018. Found in 1 HN submission from Oct 2016 to Oct 2016. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments8 threads

  1. Adversarial Examples That Fool Both Computer Vision and Time-Limited Humans 1 comment

    • Speaking of similarity between CV and human visual systems; it was kinda striking to me just how psychedelic/"trippy" the "universal adversarial perturbations" (see page 5 in https://arxiv.org/pdf/1610.08401.pdf) look. Indeed, the look of visual hallucination "form constants" is…

      zkmsView on HNParent context

  2. One pixel attack for deceiving deep neural networks 1 comment
  3. AI Model Fundamentally Cracks Captchas, Scientists Say 1 comment

    • Actually, no [1]. From the abstract: We can cause the network to misclassify an image by applying a certain imperceptible perturbation, which is found by maximizing the network's prediction error. In addition, the specific nature of these perturbations is not a random artifact…

      yorwbaView on HNParent context

  4. Robust Adversarial Examples 1 comment

    • I am unsure what you mean-- do you mean with different training sets but the same testing set? It's an interesting question; maybe the reason for (some) of these adversarial vulnerabilities is due to a handful of bad training examples. You could formulate it as a search problem…

      clickokView on HNParent context

  5. Noninvasive Deep Brain Stimulation via Temporally Interfering Electric Fields 1 comment

    • This reminds me of those blinky goggles that made you see a bunch of trippy patterns (even though the blinkiness was completely diffuse!), here's the instructions (http://wealoneonearth.blogspot.com/2009/09/how-to-build-gogg...) and here's a proper scientific paper about this…

      zkmsView on HNParent context

  6. OpenNMT: Open-Source Neural Machine Translation 1 comment

    • This is obviously data dependent. I suspect that the advantage of human is much higher in colloquial content vs written (esp. news) content. "Universal Adversarial Perturbations"[1] last year showed that you can easily generate reasonable (to human) perturbations to completely…

      vicayaView on HNParent context

  7. Show HN: Interactive deep convnet visualization for Keras and Tensorflow 1 comment

    • https://arxiv.org/pdf/1610.08401v1.pdf Sorry, I have to ask.. any relation to Dan Fortunato? Maybe that's just a really common name in Boston.

      taliesinbView on HNParent context

  8. How close are we to solving vision? 1 comment

    • "Generative models are only vulnerable to adversarial examples that are actually unlikely in the data distribution. They do not have patterns or filters that can be added to ordinary images to cause wild misclassifications." ^ Actually, you are wrong on this. See this recent…

      oifnwoivnoinvoView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.