mlsanityData to 7 Oct 2026

FG-UAP: Feature-Gathering Universal Adversarial Perturbation

arXiv 2209.13113 ↗First posted 27 Sep 2022cs.CV cs.CR cs.LGcited by 4

Not on the map. Why?

Abstract (arXiv)

Deep Neural Networks (DNNs) are susceptible to elaborately designed perturbations, whether such perturbations are dependent or independent of images. The latter one, called Universal Adversarial Perturbation (UAP), is very attractive for model robustness analysis, since its independence of input reveals the intrinsic characteristics of the model. Relatively, another interesting observation is Neural Collapse (NC), which means the feature variability may collapse during the terminal phase of training. Motivated by this, we propose to generate UAP by attacking the layer where NC phenomenon happens. Because of NC, the proposed attack could gather all the natural images' features to its surrounding, which is hence called Feature-Gathering UAP (FG-UAP). We evaluate the effectiveness our proposed algorithm on abundant experiments, including untargeted and targeted universal attacks, attacks under limited dataset, and transfer-based black-box attacks among different architectures including Vision Transformers, which are believed to be more robust. Furthermore, we investigate FG-UAP in the view of NC by analyzing the labels and extracted features of adversarial examples, finding that collapse phenomenon becomes stronger after the model is corrupted. The code will be released when the paper is accepted.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Builds on 33 of its 47 references that are in the map. First posted on arXiv 27 Sep 2022.

Builds on

33 of 47 references.

References · 33

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  9. 2014Going Deeper with Convolutionscited by 4,231
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  12. 2016Optimization Methods for Large-Scale Machine Learningcited by 1,140
21 more
  1. 2016Universal adversarial perturbationscited by 774
  2. 2020Prevalence of Neural Collapse during the terminal phase of deep learning trainingcited by 713
  3. 2017One pixel attack for fooling deep neural networkscited by 579
  4. 2021A Geometric Analysis of Neural Collapse with Unconstrained Featurescited by 226
  5. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  6. 2021Neural Collapse Under MSE Loss: Proximity to and Dynamics on the Central Pathcited by 156
  7. 2017Generative Adversarial Perturbationscited by 153
  8. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 151
  9. 2021On the Adversarial Robustness of Vision Transformerscited by 104
  10. 2022Extended Unconstrained Features Model for Exploring Deep Neural Collapsecited by 101
  11. 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
  12. 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
  13. 2017NAG: Network for Adversary Generationcited by 51
  14. 2020On the emergence of simplex symmetry in the final and penultimate layers of neural network classifierscited by 51
  15. 2020Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNetcited by 45
  16. 2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
  17. 2022Do More Negative Samples Necessarily Hurt in Contrastive Learning?cited by 39
  18. 2018Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressionscited by 31
  19. 2019Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defensescited by 22
  20. 2020Analysis of Dominant Classes in Universal Adversarial Perturbationscited by 4
  21. 2021Dominant Patterns: Critical Features Hidden in Deep Neural Networkscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 2; 2026: 1.

4 papers.

  1. 2024Attacking Transformers with Feature Diversity Adversarial Perturbationcited by 3
  2. 2025GenoArmory: A Unified Evaluation Framework for Adversarial Attacks on Genomic Foundation Modelscited by 2
  3. 2025A Novel and Practical Universal Adversarial Perturbations against Deep Reinforcement Learning based Intrusion Detection Systemscited by 1
  4. 2026Probabilistic Robustness-driven Universal Adversarial Perturbations with Explainability against Deep Reinforcement Learning-based Intrusion Detection Systemcited by 0