Data to 7 Oct 2026

Universal adversarial perturbations

arXiv 1610.08401 ↗First posted 26 Oct 2016cs.CV cs.AI cs.LGcited by 774

Not on the map. Why?

Cited by 42 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Given a state-of-the-art deep neural network classifier, we show the existence of a universal (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable to such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze these universal perturbations and show, in particular, that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important geometric correlations among the high-dimensional decision boundary of classifiers. It further outlines potential security breaches with the existence of single directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.

Key facts. Cited by 774 papers in the map (data through 7 Oct 2026). First posted on arXiv 26 Oct 2016.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 199; 2022: 175; 2023: 145; 2024: 112; 2025: 90; 2026: 53.

774 papers.

Sort:

By area:

2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
2023PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Promptscited by 218
2022Extremely Simple Activation Shaping for Out-of-Distribution Detectioncited by 212
2021Fast Yet Effective Machine Unlearningcited by 209
2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
2022Backdoor Defense via Decoupling the Training Processcited by 149
2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 101
2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97

38 more

2023Self-Supervised Learning for Time Series Analysis: Taxonomy, Progress, and Prospectscited by 97
2021Trustworthy AI: A Computational Perspectivecited by 93
2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 88
2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
2021Hidden Backdoors in Human-Centric Language Modelscited by 83
2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 78
2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
2021Towards Robustness Against Natural Language Word Substitutionscited by 68
2021On Generating Transferable Targeted Perturbationscited by 65
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
2021A Survey On Universal Adversarial Attackcited by 59
2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
2023Adversarial Demonstration Attacks on Large Language Modelscited by 58
2021Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNscited by 57
2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
2021CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakescited by 54
2021Can stable and accurate neural networks be computed? -- On the barriers of deep learning and Smale's 18th problemcited by 53
2022Robust Semantic Communications with Masked VQ-VAE Enabled Codebookcited by 53
2024UnsafeBench: Benchmarking Image Safety Classifiers on Real-World and AI-Generated Imagescited by 52
2021Fooling thermal infrared pedestrian detectors in real world using small bulbscited by 51
2021Adversarial Example Detection for DNN Models: A Review and Experimental Comparisoncited by 51
2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
2021RDA: Robust Domain Adaptation via Fourier Adversarial Attackingcited by 48
2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
2023Adversarial Counterfactual Visual Explanationscited by 47
2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
2024Cross-Modality Perturbation Synergy Attack for Person Re-identificationcited by 45
2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
2021Optical Adversarial Attackcited by 43
2023SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detectioncited by 43
2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
2023RoboBEV: Towards Robust Bird's Eye View Perception under Corruptionscited by 42
2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
2021Why AI is Harder Than We Thinkcited by 40
2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 40

50 most cited of 774 All 774 (JSON)