Research map / Adversarial robustness and security / Black-box and transfer attacks
Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PSP-UAP, a data-free universal adversarial perturbation method that treats the UAP itself (plus noise) as a pseudo-semantic prior, sampling cropped regions with input transformations and KL-based sample reweighting.
Problem
Data-free universal adversarial perturbations generated from random noise lack semantic content, which limits their black-box transferability to unseen CNN models.
Approach
Use the generated UAP plus random noise as a pseudo-semantic prior: randomly crop and resize regions of it to create semantic samples, apply input transformations (rotation, scaling, shuffling) that become effective due to the semantic content, and reweight samples by the inverse KL divergence so hard-to-fool samples get more weight.
Key results
- Achieves 89.95% average white-box fooling rate across five CNNs, the highest among data-free UAP methods (TRM-UAP 86.39%).
- Black-box average FR on ResNet152 surrogate reaches 79.28% vs 65.81% for TRM-UAP.
- Outperforms data-dependent SGA-UAP and AT-UAP-S on several black-box surrogate settings (e.g., VGG16 surrogate on ResNet152 target: 74.10% vs 49.02% SGA-UAP).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use pseudo-semantic samples cropped from the UAP instead of random noise (ablation) | Data-free UAP training · ImageNet validation | FR (%) | Helped |
| Add sample reweighting for semantic samples (ablation) | PSP-UAP · ImageNet validation | FR (%) | Helped |
| Apply input transformations to semantic samples (ablation) | PSP-UAP · ImageNet validation | FR (%) | Helped |
| Combine sample reweighting with input transformation (ablation) | PSP-UAP · ImageNet validation | FR (%) | Helped |
| Apply input transformation directly to random noise rather than semantic samples (ablation) | Data-free UAP training · ImageNet validation | average FR (%) | Hurt |
| Use PSP-UAP instead of AT-UAP-U | ImageNet classification attacks · ImageNet validation, average across five CNNs | FR (%): 87.95 -> 89.95 | Helped |
| Use PSP-UAP instead of TRM-UAP | Universal attacks on additional CNNs · ImageNet validation, average across four additional CNNs | average FR (%): 56.57 -> 64.13 | Helped |
| Use PSP-UAP instead of TRM-UAP | Universal attacks on GoogleNet · ImageNet validation, black-box transfer from GoogleNet | average FR (%): 72.78 -> 72.39 | Hurt |
Surprising findings
- Input transformations degrade performance when applied to plain random noise but help when applied to pseudo-semantic samples.
- Performance remains stable even with only N=1 semantic sample per iteration.
Limitations
- White-box FR is slightly lower than some baselines on AlexNet and GoogleNet.
- Hyperparameters such as scaling bounds and temperatures are tuned per model; very extreme scaling values degrade performance.
- GoogleNet black-box performance is slightly below TRM-UAP.
Experimental setup
Datasets: ImageNet
Benchmarks: ImageNet validation set
Metrics: fooling rate
Baselines: FFF GD-UAP PD-UA Cosine-UAP AT-UAP TRM-UAP SGA-UAP AAA
Builds on: GD-UAP TRM-UAP L2T Cosine-UAP DIM
Closest papers by meaning
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.93)
- Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · similarity 0.90)
- Generate Universal Adversarial Perturbations for Few-Shot Learning (NeurIPS 2024 · similarity 0.90)
- Democratic Training Against Universal Adversarial Perturbations (ICLR 2025 · similarity 0.88)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.87)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.