# Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networks

arXiv: https://arxiv.org/abs/1810.00470 · HTML: https://mlsanity.com/paper/1810.00470/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Sep 2018.

## Built on by (most cited first, 21 of 21)

- ["Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practice](https://mlsanity.com/paper/2212.14315/) (2022)
- [Object Removal Attacks on LiDAR-based 3D Object Detectors](https://mlsanity.com/paper/2102.03722/) (2021)
- [Smart App Attack: Hacking Deep Learning Models in Android Apps](https://mlsanity.com/paper/2204.11075/) (2022)
- [Analysis and Extensions of Adversarial Training for Video Classification](https://mlsanity.com/paper/2206.07953/) (2022)
- [UniCR: Universally Approximated Certified Robustness via Randomized Smoothing](https://mlsanity.com/paper/2207.02152/) (2022)
- [Real-time Adversarial Perturbations against Deep Reinforcement Learning Policies: Attacks and Defenses](https://mlsanity.com/paper/2106.08746/) (2021)
- [Real-time Detection of Practical Universal Adversarial Perturbations](https://mlsanity.com/paper/2105.07334/) (2021)
- [Realizable Universal Adversarial Perturbations for Malware](https://mlsanity.com/paper/2102.06747/) (2021)
- [Adversarial Examples Detection beyond Image Space](https://mlsanity.com/paper/2102.11586/) (2021)
- [Jacobian Regularization for Mitigating Universal Adversarial Perturbations](https://mlsanity.com/paper/2104.10459/) (2021)
- [Jacobian Ensembles Improve Robustness Trade-offs to Adversarial Attacks](https://mlsanity.com/paper/2204.08726/) (2022)
- [Anonymity Unveiled: A Practical Framework for Auditing Data Use in Deep Learning Models](https://mlsanity.com/paper/2409.06280/) (2024)
- [Perlin Noise Improve Adversarial Robustness](https://mlsanity.com/paper/2112.13408/) (2021)
- [Custom Object Detection via Multi-Camera Self-Supervised Learning](https://mlsanity.com/paper/2102.03442/) (2021)
- [BO-DBA: Query-Efficient Decision-Based Adversarial Attacks via Bayesian Optimization](https://mlsanity.com/paper/2106.02732/) (2021)
- [NetSentry: A Deep Learning Approach to Detecting Incipient Large-scale Network Attacks](https://mlsanity.com/paper/2202.09873/) (2022)
- [Sparse and Transferable Universal Singular Vectors Attack](https://mlsanity.com/paper/2401.14031/) (2024)
- [Adversarial Examples in Environment Perception for Automated Driving (Review)](https://mlsanity.com/paper/2504.08414/) (2025)
- [VICTOR: Dataset Copyright Auditing in Video Recognition Systems](https://mlsanity.com/paper/2512.14439/) (2025)
- [On Procedural Adversarial Noise Attack And Defense](https://mlsanity.com/paper/2108.04409/) (2021)
- [Zero-Sacrifice Persistent-Robustness Adversarial Defense for Pre-Trained Encoders](https://mlsanity.com/paper/2602.11204/) (2026)

## Abstract (arXiv)

Deep Convolutional Networks (DCNs) have been shown to be vulnerable to adversarial examples---perturbed inputs specifically designed to produce intentional errors in the learning algorithms at test time. Existing input-agnostic adversarial perturbations exhibit interesting visual patterns that are currently unexplained. In this paper, we introduce a structured approach for generating Universal Adversarial Perturbations (UAPs) with procedural noise functions. Our approach unveils the systemic vulnerability of popular DCN models like Inception v3 and YOLO v3, with single noise patterns able to fool a model on up to 90% of the dataset. Procedural noise allows us to generate a distribution of UAPs with high universal evasion rates using only a few parameters. Additionally, we propose Bayesian optimization to efficiently learn procedural noise parameters to construct inexpensive untargeted black-box attacks. We demonstrate that it can achieve an average of less than 10 queries per successful attack, a 100-fold improvement on existing methods. We further motivate the use of input-agnostic defences to increase the stability of models to adversarial perturbations. The universality of our attacks suggests that DCN models may be sensitive to aggregations of low-level class-agnostic features. These findings give insight on the nature of some universal adversarial perturbations and how they could be generated in other applications.