On Distinctive Properties of Universal Perturbations
Abstract
We identify properties of universal adversarial perturbations (UAPs) that distinguish them from standard adversarial perturbations. Specifically, we show that targeted UAPs generated by projected gradient descent exhibit two human-aligned properties: semantic locality and spatial invariance, which standard targeted adversarial perturbations lack. We also demonstrate that UAPs contain significantly less signal for generalization than standard adversarial perturbations -- that is, UAPs leverage non-robust features to a smaller extent than standard adversarial perturbations.
- Publication:
-
arXiv e-prints
- Pub Date:
- December 2021
- DOI:
- arXiv:
- arXiv:2112.15329
- Bibcode:
- 2021arXiv211215329P
- Keywords:
-
- Computer Science - Machine Learning;
- Computer Science - Computer Vision and Pattern Recognition