mlsanityData to 7 Oct 2026

Universal Adversarial Training with Class-Wise Perturbations

arXiv 2104.03000 ↗First posted 7 Apr 2021cs.LG cs.CVcited by 13

Not on the map. Why?

Abstract (arXiv)

Despite their overwhelming success on a wide range of applications, convolutional neural networks (CNNs) are widely recognized to be vulnerable to adversarial examples. This intriguing phenomenon led to a competition between adversarial attacks and defense techniques. So far, adversarial training is the most widely used method for defending against adversarial attacks. It has also been extended to defend against universal adversarial perturbations (UAPs). The SOTA universal adversarial training (UAT) method optimizes a single perturbation for all training samples in the mini-batch. In this work, we find that a UAP does not attack all classes equally. Inspired by this observation, we identify it as the source of the model having unbalanced robustness. To this end, we improve the SOTA UAT by proposing to utilize class-wise UAPs during adversarial training. On multiple benchmark datasets, our class-wise UAT leads superior performance for both clean accuracy and adversarial robustness against universal attack.

Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Builds on 31 of its 37 references that are in the map. First posted on arXiv 7 Apr 2021.

Builds on

31 of 37 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2016Wide Residual Networkscited by 3,057
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  6. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  8. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  9. 2016Universal adversarial perturbationscited by 774
  10. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  11. 2019Adversarial Training for Free!cited by 638
  12. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
19 more
  1. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
  2. 2017Generative Adversarial Perturbationscited by 153
  3. 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
  4. 2018Universal Adversarial Trainingcited by 85
  5. 2017Fast Feature Fool: A data independent approach to universal adversarial perturbationscited by 65
  6. 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
  7. 2021A Survey On Universal Adversarial Attackcited by 59
  8. 2020Revisiting Batch Normalization for Improving Corruption Robustnesscited by 55
  9. 2020Robustness May Be at Odds with Fairness: An Empirical Study on Class-wise Accuracycited by 45
  10. 2018Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressionscited by 31
  11. 2020CD-UAP: Class Discriminative Universal Adversarial Perturbationcited by 27
  12. 2018Defending Against Universal Perturbations With Shared Adversarial Trainingcited by 25
  13. 2020Double Targeted Universal Adversarial Perturbationscited by 23
  14. 2018With Friends Like These, Who Needs Adversaries?cited by 18
  15. 2021Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspectivecited by 18
  16. 2017Robustness of classifiers to universal perturbations: a geometric perspectivecited by 14
  17. 2020Adversarial Attack on Deep Product Quantization Network for Image Retrievalcited by 13
  18. 2020ResNet or DenseNet? Introducing Dense Shortcuts to ResNetcited by 12
  19. 2020Data from Model: Extracting Data from Non-robust and Robust Modelscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 3; 2023: 3; 2024: 2; 2025: 2; 2026: 1.

13 papers.

Sort:

By area:

  1. 2022Decoupled Adversarial Contrastive Learning for Self-supervised Adversarial Robustnesscited by 20
  2. 2022REAP: A Large-Scale Realistic Adversarial Patch Benchmarkcited by 17
  3. 2023Data Optimization in Deep Learning: A Surveycited by 6
  4. 2023Investigating Catastrophic Overfitting in Fast Adversarial Training: A Self-fitting Perspectivecited by 5
  5. 2021Adversarial Attacks and Defenses for Social Network Text Processing Applications: Techniques, Challenges and Future Research Directionscited by 4
  6. 2021Compensation Learningcited by 2
  7. 2022Hessian-Free Second-Order Adversarial Examples for Adversarial Learningcited by 2
  8. 2024Cross-Input Certified Training for Universal Perturbationscited by 1
  9. 2025Democratic Training Against Universal Adversarial Perturbationscited by 1
  10. 2023Universal Pyramid Adversarial Training for Improved ViT Performancecited by 0
  11. 2024Improving Fast Adversarial Training Paradigm: An Example Taxonomy Perspectivecited by 0
  12. 2025CAPAA: Classifier-Agnostic Projector-Based Adversarial Attackcited by 0
1 more
  1. 2026Hierarchical Refinement of Universal Multimodal Attacks on Vision-Language Modelscited by 0