Sparse and Transferable Universal Singular Vectors Attack
Not on the map. Why?
Abstract (arXiv)
The research in the field of adversarial attacks and models' vulnerability is one of the fundamental directions in modern machine learning. Recent studies reveal the vulnerability phenomenon, and understanding the mechanisms behind this is essential for improving neural network characteristics and interpretability. In this paper, we propose a novel sparse universal white-box adversarial attack. Our approach is based on truncated power iteration providing sparsity to (p,q)-singular vectors of the hidden layers of Jacobian matrices. Using the ImageNet benchmark validation subset, we analyze the proposed method in various settings, achieving results comparable to dense baselines with more than a 50% fooling rate while damaging only 5% of pixels and utilizing 256 samples for perturbation fitting. We also show that our algorithm admits higher attack magnitude without affecting the human ability to solve the task. Furthermore, we investigate that the constructed perturbations are highly transferable among different models without significantly decreasing the fooling rate. Our findings demonstrate the vulnerability of state-of-the-art models to sparse attacks and highlight the importance of developing robust machine learning systems.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 65 of its 80 references that are in the map. First posted on arXiv 25 Jan 2024.
Builds on
65 of 80 references.
References · 65
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
- 2014Going Deeper with Convolutionscited by 4,231
- 2020wav2vec 2.0: A Framework for Self-Supervised Learning of Speech Representationscited by 3,853
38 more
- 2016Wide Residual Networkscited by 3,057
- 2022Scaling Instruction-Finetuned Language Modelscited by 2,997
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
- 2016Universal adversarial perturbationscited by 774
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
- 2017One pixel attack for fooling deep neural networkscited by 579
- 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
- 2020Visual Transformers: Token-based Image Representation and Processing for Computer Visioncited by 333
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
- 2019Simple Black-box Adversarial Attackscited by 249
- 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
- 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
- 2017Generative Adversarial Perturbationscited by 153
- 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
- 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
- 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 101
- 2019Sparse and Imperceivable Adversarial Attackscited by 95
- 2018SparseFool: a few pixels make a big differencecited by 94
- 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
- 2018Universal Adversarial Trainingcited by 85
- 2020Do Wider Neural Networks Really Help Adversarial Robustness?cited by 79
- 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
- 2023Content-based Unrestricted Adversarial Attackcited by 73
- 2019Adversarial camera stickers: A physical camera-based attack on deep learning systemscited by 69
- 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
- 2018Structured Adversarial Attack: Towards General Implementation and Better Interpretabilitycited by 63
- 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
- 2021Meta Gradient Adversarial Attackcited by 55
- 2017NAG: Network for Adversary Generationcited by 51
- 2017Art of singular vectors and universal adversarial perturbationscited by 49
- 2020Learning perturbation sets for robust machine learningcited by 48
- 2018Unrestricted Adversarial Examplescited by 40
- 2020GreedyFool: Distortion-Aware Sparse Adversarial Attackcited by 37
- 2019Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attackscited by 35
- 2019On adversarial patches: real-world attack on ArcFace-100 face recognition systemcited by 35
50 most cited of 65 All 65 (JSON)
Built on by
Citing papers per year: 2025: 1.
1 paper.