mlsanityData to 14 Oct 2026

Universal Adversarial Training

arXiv 1811.11304 ↗First posted 27 Nov 2018cs.CV cs.CR cs.LGcited by 87

Not on the map. Why?

Abstract (arXiv)

Standard adversarial attacks change the predicted class label of a selected image by adding specially tailored small perturbations to its pixels. In contrast, a universal perturbation is an update that can be added to any image in a broad class of images, while still changing the predicted class label. We study the efficient generation of universal adversarial perturbations, and also efficient methods for hardening networks to these attacks. We propose a simple optimization-based universal attack that reduces the top-1 accuracy of various network architectures on ImageNet to less than 20%, while learning the universal perturbation 13X faster than the standard method. To defend against these perturbations, we propose universal adversarial training, which models the problem of robust classifier generation as a two-player min-max game, and produces robust models with only 2X the cost of natural training. We also propose a simultaneous stochastic gradient method that is almost free of extra computation, which allows us to do universal adversarial training on ImageNet.

Key facts. Cited by 87 papers in the map (data through 14 Oct 2026). First posted on arXiv 27 Nov 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 22; 2022: 17; 2023: 15; 2024: 17; 2025: 12; 2026: 4.

87 papers.

Sort:

By area:

  1. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 194
  2. 2022Generalized Federated Learning via Sharpness Aware Minimizationcited by 144
  3. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 103
  4. 2021On the effectiveness of adversarial training against common corruptionscited by 71
  5. 2021A Survey On Universal Adversarial Attackcited by 59
  6. 2021Few-shot Backdoor Defense Using Shapley Estimationcited by 41
  7. 2023On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codexcited by 41
  8. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  9. 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
  10. 2022The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Trainingcited by 23
  11. 2023Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregationcited by 22
  12. 2022Watermark Vaccine: Adversarial Attacks to Prevent Watermark Removalcited by 20
38 more
  1. 2021Meta Adversarial Training against Universal Patchescited by 19
  2. 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
  3. 2021Stereoscopic Universal Perturbations across Different Architectures and Datasetscited by 17
  4. 2022A Perturbation-Constrained Adversarial Attack for Evaluating the Robustness of Optical Flowcited by 16
  5. 2021Universal Spectral Adversarial Attacks for Deformable Shapescited by 14
  6. 2021Two Coupled Rejection Metrics Can Tell Adversarial Examples Apartcited by 14
  7. 2021Universal Adversarial Training with Class-Wise Perturbationscited by 13
  8. 2021The Feasibility and Inevitability of Stealth Attackscited by 12
  9. 2021SoK: Machine Learning Governancecited by 10
  10. 2023SoK: Realistic Adversarial Attacks and Defenses for Intelligent Network Intrusion Detectioncited by 10
  11. 2021A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Trackingcited by 9
  12. 2024Reliable Model Watermarking: Defending Against Theft without Compromising on Evasioncited by 9
  13. 2024Texture Re-scalable Universal Adversarial Perturbationcited by 9
  14. 2022Dispersed Pixel Perturbation-based Imperceptible Backdoor Trigger for Image Classifier Modelscited by 7
  15. 2026Universal Image Immunization against Diffusion-based Image Editing via Semantic Injectioncited by 7
  16. 2021Real-time Detection of Practical Universal Adversarial Perturbationscited by 6
  17. 2023Provable Unrestricted Adversarial Training without Compromise with Generalizabilitycited by 6
  18. 2023Universal Adversarial Backdoor Attacks to Fool Vertical Federated Learning in Cloud-Edge Collaborationcited by 6
  19. 2023Data Optimization in Deep Learning: A Surveycited by 6
  20. 2024Adversarial Training: A Surveycited by 6
  21. 2025HoneypotNet: Backdoor Attacks Against Model Extractioncited by 6
  22. 2021Realizable Universal Adversarial Perturbations for Malwarecited by 5
  23. 2022Dynamic Time Warping based Adversarial Framework for Time-Series Domaincited by 5
  24. 2022On the Connection between Invariant Learning and Adversarial Training for Out-of-Distribution Generalizationcited by 5
  25. 2024Unlearnable Examples For Time Seriescited by 5
  26. 2025Towards Robust Multimodal Large Language Models Against Jailbreak Attackscited by 5
  27. 2021Jacobian Regularization for Mitigating Universal Adversarial Perturbationscited by 4
  28. 2022Jacobian Ensembles Improve Robustness Trade-offs to Adversarial Attackscited by 4
  29. 2022DECK: Model Hardening for Defending Pervasive Backdoorscited by 4
  30. 2022Interpretation of Neural Networks is Susceptible to Universal Adversarial Perturbationscited by 4
  31. 2023One-stage Modality Distillation for Incomplete Multimodal Learningcited by 4
  32. 2024SSCAE -- Semantic, Syntactic, and Context-aware natural language Adversarial Examples generatorcited by 4
  33. 2024The Uncanny Valley: Exploring Adversarial Robustness from a Flatness Perspectivecited by 4
  34. 2024Efficient and Effective Universal Adversarial Attack against Vision-Language Pre-training Modelscited by 4
  35. 2025Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimizationcited by 4
  36. 2025ETA: Energy-based Test-time Adaptation for Depth Completioncited by 4
  37. 2022AdAUC: End-to-end Adversarial AUC Optimization Against Long-tail Problemscited by 3
  38. 2022Adversarial Vulnerability of Temporal Feature Networks for Object Detectioncited by 3

50 most cited of 87 All 87 (JSON)