# Comparative Evaluation of Recent Universal Adversarial Perturbations in Image Classification

arXiv: https://arxiv.org/abs/2306.11261 · HTML: https://mlsanity.com/paper/2306.11261/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 56 references that are in the map.
- First posted on arXiv 20 Jun 2023.

## Builds on (most cited first, 17 of 17)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [YOLOv3: An Incremental Improvement](https://mlsanity.com/paper/1804.02767/) (2018)
- [ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness](https://mlsanity.com/paper/1811.12231/) (2018)
- [Adversarial Examples Are Not Bugs, They Are Features](https://mlsanity.com/paper/1905.02175/) (2019)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty](https://mlsanity.com/paper/1912.02781/) (2019)
- [Delving into Transferable Adversarial Examples and Black-box Attacks](https://mlsanity.com/paper/1611.02770/) (2016)
- [Fast Feature Fool: A data independent approach to universal adversarial perturbations](https://mlsanity.com/paper/1707.05572/) (2017)
- [A Survey On Universal Adversarial Attack](https://mlsanity.com/paper/2103.01498/) (2021)
- [Transferable Perturbations of Deep Feature Distributions](https://mlsanity.com/paper/2004.12519/) (2020)
- [Universal Adversarial Perturbations: A Survey](https://mlsanity.com/paper/2005.08087/) (2020)
- [Transferable Universal Adversarial Perturbations Using Generative Models](https://mlsanity.com/paper/2010.14919/) (2020)
- [Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness](https://mlsanity.com/paper/1810.02424/) (2018)
- [GAP++: Learning to generate target-conditioned adversarial examples](https://mlsanity.com/paper/2006.05097/) (2020)

## Built on by (most cited first, 4 of 4)

- [DeepBaR: Fault Backdoor Attack on Deep Neural Network Layers](https://mlsanity.com/paper/2407.21220/) (2024)
- [Downstream Transfer Attack: Adversarial Attacks on Downstream Models with Pre-trained Vision Transformers](https://mlsanity.com/paper/2408.01705/) (2024)
- [Democratic Training Against Universal Adversarial Perturbations](https://mlsanity.com/paper/2502.05542/) (2025)
- [Adversarial Universal Stickers: Universal Perturbation Attacks on Traffic Sign using Stickers](https://mlsanity.com/paper/2502.18724/) (2025)

## Abstract (arXiv)

The vulnerability of Convolutional Neural Networks (CNNs) to adversarial samples has recently garnered significant attention in the machine learning community. Furthermore, recent studies have unveiled the existence of universal adversarial perturbations (UAPs) that are image-agnostic and highly transferable across different CNN models. In this survey, our primary focus revolves around the recent advancements in UAPs specifically within the image classification task. We categorize UAPs into two distinct categories, i.e., noise-based attacks and generator-based attacks, thereby providing a comprehensive overview of representative methods within each category. By presenting the computational details of these methods, we summarize various loss functions employed for learning UAPs. Furthermore, we conduct a comprehensive evaluation of different loss functions within consistent training frameworks, including noise-based and generator-based. The evaluation covers a wide range of attack settings, including black-box and white-box attacks, targeted and untargeted attacks, as well as the examination of defense mechanisms. Our quantitative evaluation results yield several important findings pertaining to the effectiveness of different loss functions, the selection of surrogate CNN models, the impact of training data and data size, and the training frameworks involved in crafting universal attackers. Finally, to further promote future research on universal adversarial attacks, we provide some visualizations of the perturbations and discuss the potential research directions.