Research map / Adversarial robustness and security / Attacks on text and graphs
Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DM-UAP, a dynamic max-min-min optimization that jointly perturbs model parameters and data per mini-batch with curriculum-scheduled neighborhoods to craft more generalizable universal adversarial perturbations on ImageNet.
Problem
Universal adversarial perturbations (UAPs) generated against static model snapshots and fixed data generalize poorly across samples and across models, especially with limited data.
Approach
Formulate UAP generation as a maximin over composite model-parameter and data neighborhoods, solved dynamically per mini-batch via a model-then-data min-min step, plus a curriculum that gradually enlarges the neighborhoods and uses Adam for the UAP update.
Key results
- In the white-box setting, DM-UAP reaches 95.92% average fooling ratio across AlexNet, GoogleNet, VGG16, VGG19, and ResNet152, above SGA's 94.98%.
- With 500 training images, DM-UAP improves over SPGD by 8.22% to 45.19% across surrogate models in the black-box setting and outperforms SGA by an average of 12.108%.
- Under the Transformer-to-CNN setting, DM-UAP reaches 54.58% average fooling ratio on ViT-B surrogate versus 45.51% for SGA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use dynamic maximin model-data optimization instead of static-model UAP training | UAP generation · ImageNet val, white-box (average across five models) | fooling ratio (%): 94.98 -> 95.92 | Helped |
| Use DM-UAP instead of SGA with 500 training samples | UAP generation · ImageNet val, black-box transfer | fooling ratio (%): DM-UAP outperforms SGA with an average increase in fooling ratio of 12.108%. | Helped |
| Add curriculum learning with gradually increasing model and data neighborhoods (ablation) | DM-UAP · ImageNet, 500 training images | fooling ratio | Helped |
| Optimize the model first, then optimize data (ablation) | DM-UAP · White-box attacks on five ImageNet models | fooling ratio | Helped |
| Optimize data before the model instead of model before data (ablation) | DM-UAP · White-box attacks on five ImageNet models | fooling ratio | Mixed |
| Alternate single model and data optimization steps (ablation) | DM-UAP · White-box attacks on five ImageNet models | fooling ratio | Hurt |
| Remove both model and data optimization (ablation) | DM-UAP · White-box attacks on five ImageNet models | fooling ratio | Hurt |
| Add data optimization to model-only optimization (ablation) | DM-UAP · ImageNet, varying model neighborhood size | fooling ratio | Helped |
| Add model optimization to data-only optimization (ablation) | DM-UAP · ImageNet, varying data neighborhood size | fooling ratio | Helped |
Surprising findings
- Data-Model optimization order sometimes helps, while alternating optimization consistently underperforms, supporting the model-first ordering choice.
- SGA and AT-UAP are sometimes inferior to the SPGD baseline in black-box transfer, showing prior improvements are not consistent.
Limitations
- Higher computational cost than SGA and AT-UAP (about 1.6x SGA time).
- Memory demands may limit application to larger models; the authors suggest selecting subsets of parameters for optimization.
- Performance gains plateau once the number of training samples exceeds a threshold.
Experimental setup
Datasets: ImageNet
Benchmarks: ImageNet validation set
Metrics: fooling ratio
Baselines: UAP NAG GAP DF-UAP Cos-UAP AT-UAP SGA SPGD M-SPGD M-SGA
Builds on: SPGD SGA AT-UAP DF-UAP
Closest papers by meaning
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.91)
- Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior (CVPR 2025 · similarity 0.90)
- Generate Universal Adversarial Perturbations for Few-Shot Learning (NeurIPS 2024 · similarity 0.90)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.89)
- Democratic Training Against Universal Adversarial Perturbations (ICLR 2025 · similarity 0.89)
- Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.