# Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses

arXiv: https://arxiv.org/abs/1904.00979 · HTML: https://mlsanity.com/paper/1904.00979/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Apr 2019.

## Built on by (most cited first, 23 of 23)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [On Generating Transferable Targeted Perturbations](https://mlsanity.com/paper/2103.14641/) (2021)
- [A Survey On Universal Adversarial Attack](https://mlsanity.com/paper/2103.01498/) (2021)
- [A Survey on Transferability of Adversarial Examples across Deep Neural Networks](https://mlsanity.com/paper/2310.17626/) (2023)
- [Imperceptible Transfer Attack and Defense on 3D Point Cloud Classification](https://mlsanity.com/paper/2111.10990/) (2021)
- [Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks](https://mlsanity.com/paper/2107.01809/) (2021)
- [Investigating Top-k White-Box and Transferable Black-box Attack](https://mlsanity.com/paper/2204.00089/) (2022)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Towards Good Practices in Evaluating Transfer Adversarial Attacks](https://mlsanity.com/paper/2211.09565/) (2022)
- [One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIP](https://mlsanity.com/paper/2505.19840/) (2025)
- [Reliable Evaluation of Adversarial Transferability](https://mlsanity.com/paper/2306.08565/) (2023)
- [Improving Adversarial Transferability via Model Alignment](https://mlsanity.com/paper/2311.18495/) (2023)
- [Practical No-box Adversarial Attacks with Training-free Hybrid Image Transformation](https://mlsanity.com/paper/2203.04607/) (2022)
- [SoK: Pitfalls in Evaluating Black-Box Attacks](https://mlsanity.com/paper/2310.17534/) (2023)
- [A Review of Adversarial Attacks in Computer Vision](https://mlsanity.com/paper/2308.07673/) (2023)
- [FG-UAP: Feature-Gathering Universal Adversarial Perturbation](https://mlsanity.com/paper/2209.13113/) (2022)
- [Domain Generalization Emerges from Dreaming](https://mlsanity.com/paper/2302.00980/) (2023)
- [Resilience of Autonomous Vehicle Object Category Detection to Universal Adversarial Perturbations](https://mlsanity.com/paper/2107.04749/) (2021)
- [Adversarial Attacks with Time-Scale Representations](https://mlsanity.com/paper/2107.12473/) (2021)
- [On The Relationship Between Universal Adversarial Attacks And Sparse Representations](https://mlsanity.com/paper/2311.08265/) (2023)
- [Hijacking Attacks against Neural Networks by Analyzing Training Data](https://mlsanity.com/paper/2401.09740/) (2024)
- [Improving Adversarial Transferability with Neighbourhood Gradient Information](https://mlsanity.com/paper/2408.05745/) (2024)
- [Hierarchical Refinement of Universal Multimodal Attacks on Vision-Language Models](https://mlsanity.com/paper/2601.10313/) (2026)

## Abstract (arXiv)

This paper focuses on learning transferable adversarial examples specifically against defense models (models to defense adversarial attacks). In particular, we show that a simple universal perturbation can fool a series of state-of-the-art defenses. Adversarial examples generated by existing attacks are generally hard to transfer to defense models. We observe the property of regional homogeneity in adversarial perturbations and suggest that the defenses are less robust to regionally homogeneous perturbations. Therefore, we propose an effective transforming paradigm and a customized gradient transformer module to transform existing perturbations into regionally homogeneous ones. Without explicitly forcing the perturbations to be universal, we observe that a well-trained gradient transformer module tends to output input-independent gradients (hence universal) benefiting from the under-fitting phenomenon. Thorough experiments demonstrate that our work significantly outperforms the prior art attacking algorithms (either image-dependent or universal ones) by an average improvement of 14.0% when attacking 9 defenses in the transfer-based attack setting. In addition to the cross-model transferability, we also verify that regionally homogeneous perturbations can well transfer across different vision tasks (attacking with the semantic segmentation task and testing on the object detection task). The code is available here: https://github.com/LiYingwei/Regional-Homogeneity.