mlsanityData to 14 Oct 2026

Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization

arXiv 2503.12793 ↗First posted 17 Mar 2025cs.LG cs.CVcited by 4

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) are susceptible to universal adversarial perturbations (UAPs). These perturbations are meticulously designed to fool the target model universally across all sample classes. Unlike instance-specific adversarial examples (AEs), generating UAPs is more complex because they must be generalized across a wide range of data samples and models. Our research reveals that existing universal attack methods, which optimize UAPs using DNNs with static model parameter snapshots, do not fully leverage the potential of DNNs to generate more effective UAPs. Rather than optimizing UAPs against static DNN models with a fixed training set, we suggest using dynamic model-data pairs to generate UAPs. In particular, we introduce a dynamic maximin optimization strategy, aiming to optimize the UAP across a variety of optimal model-data pairs. We term this approach DM-UAP. DM-UAP utilizes an iterative max-min-min optimization framework that refines the model-data pairs, coupled with a curriculum UAP learning algorithm to examine the combined space of model parameters and data thoroughly. Comprehensive experiments on the ImageNet dataset demonstrate that the proposed DM-UAP markedly enhances both cross-sample universality and cross-model transferability of UAPs. Using only 500 samples for UAP generation, DM-UAP outperforms the state-of-the-art approach with an average increase in fooling ratio of 12.108%.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Builds on 30 of its 39 references that are in the map. First posted on arXiv 17 Mar 2025.

Builds on

30 of 39 references.

References · 30

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
  8. 2016Universal adversarial perturbationscited by 784
  9. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  10. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  11. 2017Generative Adversarial Perturbationscited by 153
  12. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 103
18 more
  1. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  2. 2018Universal Adversarial Trainingcited by 87
  3. 2020Adversarial Distributional Training for Robust Deep Learningcited by 79
  4. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 78
  5. 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
  6. 2020Understanding Adversarial Examples from the Mutual Influence of Images and Perturbationscited by 59
  7. 2017NAG: Network for Adversary Generationcited by 51
  8. 2017Art of singular vectors and universal adversarial perturbationscited by 49
  9. 2020Enabling Fast and Universal Audio Adversarial Attack Using Generative Modelcited by 32
  10. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  11. 2024DarkSAM: Fooling Segment Anything Model to Segment Nothingcited by 32
  12. 2020CD-UAP: Class Discriminative Universal Adversarial Perturbationcited by 27
  13. 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 27
  14. 2020Double Targeted Universal Adversarial Perturbationscited by 23
  15. 2022OPOM: Customized Invisible Cloak towards Face Privacy Protectioncited by 22
  16. 2023Enhancing Generalization of Universal Adversarial Perturbation through Gradient Aggregationcited by 22
  17. 2019Universal Adversarial Robustness of Texture and Shape-Biased Modelscited by 8
  18. 2022Adversarially Robust Models may not Transfer Better: Sufficient Conditions for Domain Transferability from the View of Regularizationcited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 2.

4 papers.

  1. 2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIPcited by 21
  2. 2025BackWeak: Backdooring Knowledge Distillation Simply with Weak Triggers and Fine-tuningcited by 0
  3. 2026Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbationcited by 0
  4. 2026Generating Multi-view Adversarial Examples for Visual Geometry Grounded Transformercited by 0