# Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressions

arXiv: https://arxiv.org/abs/1808.01153 · HTML: https://mlsanity.com/paper/1808.01153/

## Key facts

- Cited by 31 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Aug 2018.

## Built on by (most cited first, 30 of 31)

- [On Generating Transferable Targeted Perturbations](https://mlsanity.com/paper/2103.14641/) (2021)
- [A Survey On Universal Adversarial Attack](https://mlsanity.com/paper/2103.01498/) (2021)
- [One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models](https://mlsanity.com/paper/2406.05491/) (2024)
- [Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks](https://mlsanity.com/paper/2107.01809/) (2021)
- [Downstream-agnostic Adversarial Examples](https://mlsanity.com/paper/2307.12280/) (2023)
- [DarkSAM: Fooling Segment Anything Model to Segment Nothing](https://mlsanity.com/paper/2409.17874/) (2024)
- [Robust Feature-Level Adversaries are Interpretability Tools](https://mlsanity.com/paper/2110.03605/) (2021)
- [Watermark Vaccine: Adversarial Attacks to Prevent Watermark Removal](https://mlsanity.com/paper/2207.08178/) (2022)
- [CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attacks](https://mlsanity.com/paper/2407.10179/) (2024)
- [PrivateSNN: Privacy-Preserving Spiking Neural Networks](https://mlsanity.com/paper/2104.03414/) (2021)
- [Universal Adversarial Training with Class-Wise Perturbations](https://mlsanity.com/paper/2104.03000/) (2021)
- [When and How to Fool Explainable Models (and Humans) with Adversarial Examples](https://mlsanity.com/paper/2107.01943/) (2021)
- [Transferable Sparse Adversarial Attack](https://mlsanity.com/paper/2105.14727/) (2021)
- [Cross-Task Attack: A Self-Supervision Generative Framework Based on Attention Shift](https://mlsanity.com/paper/2407.13700/) (2024)
- [Mining Data Impressions from Deep Models as Substitute for the Unavailable Training Data](https://mlsanity.com/paper/2101.06069/) (2021)
- [Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions](https://mlsanity.com/paper/2104.11103/) (2021)
- [Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Models](https://mlsanity.com/paper/2412.11423/) (2024)
- [Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systems](https://mlsanity.com/paper/2311.11796/) (2023)
- [Investigating White-Box Attacks for On-Device Models](https://mlsanity.com/paper/2402.05493/) (2024)
- [Effective Universal Unrestricted Adversarial Attacks using a MOE Approach](https://mlsanity.com/paper/2103.00250/) (2021)
- [MINIMAL: Mining Models for Data Free Universal Adversarial Triggers](https://mlsanity.com/paper/2109.12406/) (2021)
- [FG-UAP: Feature-Gathering Universal Adversarial Perturbation](https://mlsanity.com/paper/2209.13113/) (2022)
- [Dynamic Object Removal for Effective Slam](https://mlsanity.com/paper/2303.10923/) (2023)
- [Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior](https://mlsanity.com/paper/2502.21048/) (2025)
- [Sample-agnostic Adversarial Perturbation for Vision-Language Pre-training Models](https://mlsanity.com/paper/2408.02980/) (2024)
- [Dominant Patterns: Critical Features Hidden in Deep Neural Networks](https://mlsanity.com/paper/2105.15057/) (2021)
- [Learning video embedding space with Natural Language Supervision](https://mlsanity.com/paper/2303.14584/) (2023)
- [Universal Perturbation-based Secret Key-Controlled Data Hiding](https://mlsanity.com/paper/2311.01696/) (2023)
- [On The Relationship Between Universal Adversarial Attacks And Sparse Representations](https://mlsanity.com/paper/2311.08265/) (2023)
- [Universal Multi-view Black-box Attack against Object Detectors via Layout Optimization](https://mlsanity.com/paper/2407.06688/) (2024)

## Abstract (arXiv)

Deep learning models are susceptible to input specific noise, called adversarial perturbations. Moreover, there exist input-agnostic noise, called Universal Adversarial Perturbations (UAP) that can affect inference of the models over most input samples. Given a model, there exist broadly two approaches to craft UAPs: (i) data-driven: that require data, and (ii) data-free: that do not require data samples. Data-driven approaches require actual samples from the underlying data distribution and craft UAPs with high success (fooling) rate. However, data-free approaches craft UAPs without utilizing any data samples and therefore result in lesser success rates. In this paper, for data-free scenarios, we propose a novel approach that emulates the effect of data samples with class impressions in order to craft UAPs using data-driven objectives. Class impression for a given pair of category and model is a generic representation (in the input space) of the samples belonging to that category. Further, we present a neural network based generative model that utilizes the acquired class impressions to learn crafting UAPs. Experimental evaluation demonstrates that the learned generative model, (i) readily crafts UAPs via simple feed-forwarding through neural network layers, and (ii) achieves state-of-the-art success rates for data-free scenario and closer to that for data-driven setting without actually utilizing any data samples.