Research map / Adversarial robustness and security / Attacks on text and graphs
Learning Universal Adversarial Perturbation by Adversarial Example
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add instance-specific adversarial examples as UAP training inputs (ablation) | UAP generation · ImageNet validation, data-independent | fooling ratio (%): 72.07 -> 96.66 (AlexNet); 35.83 -> 82.60 (GoogleNet); 51.14 -> 94.50 (VGG16); 40.49 -> 92.85 (VGG19); 26.14 -> 73.15 (Re | Helped |
| add instance-specific adversarial examples as UAP training inputs instead of Gaussian noise (ablation) | UAP generation · ImageNet validation, data-independent | fooling ratio (%): 56.80 -> 96.66 (AlexNet); 24.27 -> 82.60 (GoogleNet); 30.56 -> 94.50 (VGG16); 27.75 -> 92.85 (VGG19); 19.47 -> 73.15 (Re | Helped |
| use the consistency regularizer (ablation) | proposed UAP method · ImageNet validation, data-independent | fooling ratio (%): 96.29±0.17 -> 96.66±0.12 (AlexNet); 80.08±0.84 -> 82.60±0.72 (GoogleNet); 93.67±0.24 -> 94.50±0.21 (VGG16); 92.08±0.43 - | Helped |
| use the consistency regularizer (ablation) | proposed UAP method · ImageNet validation, data-dependent | fooling ratio (%): 96.59±0.17 -> 97.01±0.11 (AlexNet); 90.35±0.26 -> 90.82±0.29 (GoogleNet); 96.94±0.16 -> 97.51±0.08 (VGG16); 97.11±0.04 - | Helped |
| use the proposed method rather than the strongest listed baseline | data-dependent UAP generation · ImageNet validation, AlexNet, GoogleNet, VGG16, VGG19, and ResNet152 | fooling ratio (%): 97.01±0.11 vs 96.44; 90.82±0.29 vs 90.37; 97.51±0.08 vs 94.30; 97.56±0.04 vs 94.98; 91.52±0.78 vs 90.08 | Helped |
| use the proposed method rather than the strongest listed baseline | data-independent UAP generation · ImageNet validation, AlexNet, GoogleNet, VGG16, VGG19, and ResNet152 | fooling ratio (%): 96.66±0.12 vs 96.17; 82.60±0.72 vs 88.94; 94.50±0.21 vs 94.30; 92.85±0.48 vs 94.98; 73.15±1.15 vs 60.72 | Mixed |
| replace instance-specific adversarial examples with Gaussian noise (ablation) | UAP generation · ImageNet validation, data-dependent | fooling ratio (%): 96.26 (AlexNet); 89.13 (GoogleNet); 94.49 (VGG16); 95.35 (VGG19); 90.46 (ResNet152) | No clear effect |
Closest papers by meaning
- Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · similarity 0.93)
- Generate Universal Adversarial Perturbations for Few-Shot Learning (NeurIPS 2024 · similarity 0.92)
- Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior (CVPR 2025 · similarity 0.92)
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.92)
- Democratic Training Against Universal Adversarial Perturbations (ICLR 2025 · similarity 0.91)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.