# Simple iterative method for generating targeted universal adversarial perturbations

arXiv: https://arxiv.org/abs/1911.06502 · HTML: https://mlsanity.com/paper/1911.06502/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Nov 2019.

## Built on by (most cited first, 14 of 14)

- [One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIP](https://mlsanity.com/paper/2505.19840/) (2025)
- [A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Tracking](https://mlsanity.com/paper/2105.02480/) (2021)
- [Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions](https://mlsanity.com/paper/2104.11103/) (2021)
- [You Only Query Once: Effective Black Box Adversarial Attacks with Minimal Repeated Queries](https://mlsanity.com/paper/2102.00029/) (2021)
- [Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systems](https://mlsanity.com/paper/2407.08514/) (2024)
- [Simple black-box universal adversarial attacks on medical image classification based on deep neural networks](https://mlsanity.com/paper/2108.04979/) (2021)
- [Universal Adversarial Directions](https://mlsanity.com/paper/2210.15997/) (2022)
- [A reading survey on adversarial machine learning: Adversarial attacks and their understanding](https://mlsanity.com/paper/2308.03363/) (2023)
- [Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization](https://mlsanity.com/paper/2601.23179/) (2026)
- [Cortical Features for Defense Against Adversarial Audio Attacks](https://mlsanity.com/paper/2102.00313/) (2021)
- [Adversarial attacks on hybrid classical-quantum Deep Learning models for Histopathological Cancer Detection](https://mlsanity.com/paper/2309.06377/) (2023)
- [On The Relationship Between Universal Adversarial Attacks And Sparse Representations](https://mlsanity.com/paper/2311.08265/) (2023)
- [Hijacking Attacks against Neural Networks by Analyzing Training Data](https://mlsanity.com/paper/2401.09740/) (2024)
- [Test-Time Collective Action: Proxy-Based Perturbations for Correcting Algorithmic Harms](https://mlsanity.com/paper/2605.27689/) (2026)

## Abstract (arXiv)

Deep neural networks (DNNs) are vulnerable to adversarial attacks. In particular, a single perturbation known as the universal adversarial perturbation (UAP) can foil most classification tasks conducted by DNNs. Thus, different methods for generating UAPs are required to fully evaluate the vulnerability of DNNs. A realistic evaluation would be with cases that consider targeted attacks; wherein the generated UAP causes DNN to classify an input into a specific class. However, the development of UAPs for targeted attacks has largely fallen behind that of UAPs for non-targeted attacks. Therefore, we propose a simple iterative method to generate UAPs for targeted attacks. Our method combines the simple iterative method for generating non-targeted UAPs and the fast gradient sign method for generating a targeted adversarial perturbation for an input. We applied the proposed method to state-of-the-art DNN models for image classification and proved the existence of almost imperceptible UAPs for targeted attacks; further, we demonstrated that such UAPs are easily generatable.