Universal adversarial perturbations
Seyed-Mohsen Moosavi-Dezfooli∗ † Alhussein Fawzi∗ † [email protected] [email protected] Omar Fawzi‡ Pascal Frossard† [email protected] [email protected]
∗The first two authors contributed equally to this work. †Ecole´ Polytechnique Fed´ erale´ de Lausanne, Switzerland ‡ENS de Lyon, LIP, UMR 5668 ENS Lyon - CNRS - UCBL - INRIA, Universite´ de Lyon, France
1 A. Appendix Fig. A.1 shows the original images corresponding to the experiment in Fig.3. Fig. A.2 visualizes the graph showing relations between original and perturbed labels (see Section3 for more details).
Bouvier des Flandres Christmas stocking Scottish deerhound ski mask
porcupine killer whale European fire salamander toyshop
fox squirrel pot Arabian camel coffeepot
Figure A.1: Original images. The first two rows are randomly chosen images from the validation set, and the last row of images are personal images taken from a mobile phone camera. tick
long-horned beetle
African chameleon
green snake
tree frog
hammer
cricket strainer
catamaran junco espresso maker hermit crab black and gold garden spider weevil burrito mortarboard modem axolotl cliff dwelling nail mantis maillot binoculars sturgeon planetarium
rhinoceros beetle washbasin dough chime breastplate Maltese dog missile muzzle snowmobile plane photocopier lacewing common iguana military uniform oboe acoustic guitar carton loupe abaya
yawl pencil sharpener crane suspension bridge tub green lizard grasshopper Pembroke swimming trunks hartebeest walking stick �ireboat American chameleon golf ball bathtub sulphur-crested cockatoo ice cream grey whale cougar barbershop cleaver wing Lhasa �lute drilling platform sandal desk promontory water ouzel hay castle hair spray passenger car Band Aid banded gecko barbell green mamba suit Walker hound wok gasmask
African crocodile dogsled washer switch giant schnauzer oystercatcher saltshaker seat belt scale water snake speedboat patio loudspeaker trench coat ping-pong ball valley volcano can opener assault ri�le tank pool table schipperke re�lex camera consomme boathouse night snake backpack Kerry blue terrier folding chair plastic bag red-backed sandpiper bikini bobsled bannister quill sliding door megalith snowplow mixing bowl garden spider pier liner plunger brassiere Eskimo dog Great Pyrenees syringe cornet bell cote studio couch killer whale llama groom lifeboat viaduct rubber eraser Pekinese chickadee ice bear submarine barn moving van house �inch knee pad gown drum radiator vase stove power drill chocolate sauce
kite steel arch bridge guillotine albatross palace wig sandbar nipple wreck balance beam letter opener African grey harvester bow tie chest Persian cat safe diaper lab coat punching bag
pole toilet tissue stethoscope stupa violin �lagpole mosque tripod Petri dish purse cocktail shaker mailbag breakwater spatula chiffonier cliff sunglass amphibian container ship thatch oxygen mask harmonica ski paintbrush dock white stork window shade plate conch microphone dam convertible mouse seashore measuring cup garbage truck car mirror solar dish radio telescope pedestal Loafer volleyball microwave paper towel trailer truck dining table soap dispenser fountain pen grand piano whistle whiskey jug joystick television toaster cash machine screwdriver balloon spotlight corkscrew CD player hook bassoon ladle cowboy hat refrigerator frying pan projectile Dutch oven space heater home theater shoji desktop computer alp tray bucket turnstile mosquito net caldron dumbbell cassette player airship pillow ruddy turnstone beacon cannon steam locomotive geyser worm fence pirate computer keyboard vacuum teapot pencil box sunscreen table lamp iron quilt Crock Pot ballpoint hand blower wardrobe mountain tent trimaran racket plate rack cradle drumstick aircraft carrier traf�ic light mobile home
envelope airliner medicine chest lakeside
printer mousetrap warplane church Samoyed potter's wheel monastery water tower
African elephant
neck brace prison projector
Polaroid camera iPod
fur coat black widow shovel Indian elephant toy poodle
miniskirt sloth bear pickelhaube cello miniature poodle
maillot cockroach
sax spindle
crutch
cray�ish banana
American lobster wine bottle
espresso beaker cup
ringneck snake leopard nematode
thimble oil �ilter eggnog slide rule
coffeepot dowitcher space shuttle
china cabinet great grey owl
lipstick
platypus
Windsor tie admiral ladybug ri�le fountain perfume gold�inch coffee mug
tiger shark digital clock Arctic fox bell pepper damsel�ly jersey cardigan hornbill Siberian husky soup bowl
�ly sulphur butter�ly indigo bunting chambered nautilus hummingbird jay
bulletproof vest jacamar cinema water jug bulbul
jack-o'-lantern parachute lea�hopper
red wine jelly�ish lampshade macaw stage sunglasses ant lighter
American egret matchstick screen
barn spider lemon monitor ski mask cloak obelisk mask hammerhead electric ray oscilloscope tennis ball parallel bars upright
shower cap wallet tape player great white shark lycaenid leaf beetle stingray crash helmet beer glass
lens cap vine snake Angora
torch notebook
binder magpie bee eater dugong dragon�ly
mortar electric guitar schooner maraca
scuba diver cabbage butter�ly
hotdog bald eagle lotion sweatshirt candle pinwheel
rule
face powder Egyptian cat ice lolly pill bottle crate
wooden spoon mitten
tabby wool broom tiger cat knot
bath towel velvet lynx
Granny Smith
spaghetti squash cheeseburger butternut squash
barrel
strawberry pick
Figure A.2: Graph representing the relation between original and perturbed labels. Note that “dominant labels” appear systematically. Please zoom for readability. Isolated nodes are removed from this visualization for readability.