Research map / Adversarial robustness and security / Black-box and transfer attacks
Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IntriUAP, a data-free universal adversarial perturbation method that aligns the UAP with the top right singular vectors of each linear layer in L1LOS (linear + 1-Lipschitz nonlinear) image classifiers.
Problem
Generating universal adversarial perturbations (UAPs) usually requires many real samples and labels, which is impractical under data privacy or access limits; the paper asks whether UAPs can be built without any data from intrinsic model properties.
Approach
Argues that in L1LOS networks (linear layers plus 1-Lipschitz nonlinearities) vulnerability is dominated by the linear layers, so the UAP is optimized to align with the maximal right singular vector of each linear layer, requiring no data or training loss.
Key results
- Achieves 94.03% fooling ratio on AlexNet and 93.40% on VGG16 in the white-box setting without any image samples, outperforming listed data-free baselines on those models.
- On ResNet152 and GoogleNet the method reaches 65.47% and 60.42%, below Cos-UAP (65.35% on ResNet152 is roughly tied; 87.57% on GoogleNet), so it is not uniformly best.
- With only 50% of linear layers accessible, AlexNet fooling ratio is 90.01% versus 94.03% at full access, a drop of about 4 points.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IntriUAP instead of Cos-UAP | AlexNet · ImageNet ILSVRC2012 val | fooling ratio (%): 91.07 -> 94.03 | Helped |
| Use IntriUAP instead of Cos-UAP | GoogleNet · ImageNet ILSVRC2012 val | fooling ratio (%): 87.57 -> 60.42 | Hurt |
| Use IntriUAP instead of DF-UAP | VGG16 · ImageNet ILSVRC2012 val | fooling ratio (%): 92.20 -> 93.40 | Helped |
| Use IntriUAP instead of DF-UAP | VGG19 · ImageNet ILSVRC2012 val | fooling ratio (%): 91.60 -> 92.28 | Helped |
| Use IntriUAP instead of DF-UAP | ResNet152 · ImageNet ILSVRC2012 val | fooling ratio (%): 79.9 -> 65.47 | Hurt |
| Use Uniform initialization instead of Range Prior (ablation) | IntriUAP · ImageNet ILSVRC2012 val, AlexNet | fooling ratio (%): 91.60 -> 92.58 | Helped |
| Use Uniform initialization instead of Range Prior (ablation) | IntriUAP · ImageNet ILSVRC2012 val, GoogleNet | fooling ratio (%): 60.42 -> 45.56 | Hurt |
| Use Gaussian initialization instead of Range Prior (ablation) | IntriUAP · ImageNet ILSVRC2012 val, VGG16 | fooling ratio (%): 93.40 -> 86.03 | Hurt |
| Use Gaussian initialization instead of Range Prior (ablation) | IntriUAP · ImageNet ILSVRC2012 val, GoogleNet | fooling ratio (%): 60.42 -> 47.80 | Hurt |
| Reduce white-box access from 100% to 50% (ablation) | IntriUAP on AlexNet · ImageNet ILSVRC2012 val | fooling ratio (%): 94.03 -> 90.01 | Hurt |
| Reduce white-box access from 100% to 75% (ablation) | IntriUAP on VGG16 · ImageNet ILSVRC2012 val | fooling ratio (%): 93.40 -> 91.49 | Hurt |
| Reduce white-box access from 100% to 75% (ablation) | IntriUAP on VGG19 · ImageNet ILSVRC2012 val | fooling ratio (%): 92.28 -> 91.31 | Hurt |
Surprising findings
- Performance on GoogleNet (60.42%) is far below the data-free Cos-UAP (87.57%), indicating the approach does not generalize across all L1LOS architectures.
Limitations
- Validated only on torchvision image classifiers judged to be L1LOS; GoogleNet and ResNet152 results are weaker than data-free baselines.
- Theory relies on the L1LOS assumption and BatchNorm treated as linear at inference time.
- Only classification studied; perturbation bound fixed at l-inf 10 on [0,255] scale.
Experimental setup
Datasets: ImageNet ILSVRC2012 validation set (evaluation only)
Benchmarks: ImageNet ILSVRC2012 validation set
Metrics: fooling ratio
Baselines: UAP SV-UAP NAG GAP AT-UAP SGA-UAP FFF AAA GD-UAP PD-UAP DF-UAP Cos-UAP
Builds on: Universal Adversarial Perturbations Fast Feature Fool GD-UAP Cos-UAP
Closest papers by meaning
- Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior (CVPR 2025 · similarity 0.93)
- Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · similarity 0.91)
- Democratic Training Against Universal Adversarial Perturbations (ICLR 2025 · similarity 0.90)
- Generate Universal Adversarial Perturbations for Few-Shot Learning (NeurIPS 2024 · similarity 0.88)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.86)
- Transferable Adversarial Attacks on SAM and Its Downstream Models (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.