Universal adversarial perturbations

Seyed-Mohsen Moosavi-Dezfooli∗ † Alhussein Fawzi∗ † [email protected] [email protected] Omar Fawzi‡ Pascal Frossard† [email protected] [email protected]

∗The first two authors contributed equally to this work. †Ecole´ Polytechnique Fed´ erale´ de Lausanne, Switzerland ‡ENS de Lyon, LIP, UMR 5668 ENS Lyon - CNRS - UCBL - INRIA, Universite´ de Lyon, France

1 A. Appendix Fig. A.1 shows the original images corresponding to the experiment in Fig.3. Fig. A.2 visualizes the graph showing relations between original and perturbed labels (see Section3 for more details).

Bouvier des Flandres Christmas stocking Scottish deerhound ski mask

porcupine killer whale European fire salamander toyshop

fox squirrel pot Arabian camel coffeepot

Figure A.1: Original images. The first two rows are randomly chosen images from the validation set, and the last row of images are personal images taken from a mobile phone camera. tick

long-horned beetle

African chameleon

green snake

tree frog

hammer

cricket strainer

catamaran junco espresso maker hermit crab black and gold garden spider weevil burrito mortarboard modem axolotl cliff dwelling nail mantis maillot binoculars sturgeon planetarium

rhinoceros beetle washbasin dough chime breastplate Maltese dog missile muzzle snowmobile plane photocopier lacewing common iguana military oboe acoustic guitar carton loupe abaya

yawl pencil sharpener crane suspension bridge tub green lizard grasshopper Pembroke swimming trunks hartebeest walking stick �ireboat American chameleon golf ball bathtub sulphur-crested cockatoo ice cream grey whale cougar barbershop cleaver wing Lhasa �lute drilling platform sandal desk promontory water ouzel hay castle hair spray passenger car Band Aid banded gecko barbell green mamba suit Walker hound wok gasmask

African crocodile dogsled washer switch giant schnauzer oystercatcher saltshaker seat belt scale water snake speedboat patio loudspeaker trench coat ping-pong ball valley volcano can opener assault ri�le tank pool table schipperke re�lex camera consomme boathouse night snake backpack Kerry blue terrier folding chair plastic bag red-backed sandpiper bikini bobsled bannister quill sliding door megalith snowplow mixing bowl garden spider pier liner plunger brassiere Eskimo dog Great Pyrenees syringe cornet bell cote studio couch killer whale llama groom lifeboat viaduct rubber eraser Pekinese chickadee ice bear submarine barn moving van house �inch knee pad gown drum radiator vase stove power drill chocolate sauce

kite steel arch bridge guillotine albatross palace wig sandbar nipple wreck balance beam letter opener African grey harvester bow tie chest Persian cat safe diaper lab coat punching bag

pole toilet tissue stethoscope stupa violin �lagpole mosque tripod Petri dish purse cocktail shaker mailbag breakwater spatula chiffonier cliff sunglass amphibian container ship thatch oxygen mask harmonica ski paintbrush dock white stork window shade plate conch microphone dam convertible mouse seashore measuring cup garbage truck car mirror solar dish radio telescope pedestal Loafer volleyball microwave paper towel trailer truck dining table soap dispenser fountain pen grand piano whistle whiskey jug joystick television toaster cash machine screwdriver balloon spotlight corkscrew CD player hook bassoon ladle cowboy refrigerator frying pan projectile Dutch oven space heater home theater shoji desktop computer alp tray bucket turnstile mosquito net caldron dumbbell cassette player airship pillow ruddy turnstone beacon cannon steam locomotive geyser worm fence pirate computer keyboard vacuum teapot pencil box sunscreen table lamp iron quilt Crock Pot ballpoint hand blower wardrobe mountain tent trimaran racket plate rack cradle drumstick aircraft carrier traf�ic light mobile home

envelope airliner medicine chest lakeside

printer mousetrap warplane church Samoyed potter's wheel monastery water tower

African elephant

neck brace prison projector

Polaroid camera iPod

fur coat black widow shovel Indian elephant toy poodle

miniskirt sloth bear pickelhaube cello miniature poodle

maillot cockroach

sax spindle

crutch

cray�ish banana

American lobster wine bottle

espresso beaker cup

ringneck snake leopard nematode

thimble oil �ilter eggnog slide rule

coffeepot dowitcher space shuttle

china cabinet great grey owl

lipstick

platypus

Windsor tie admiral ladybug ri�le fountain perfume gold�inch coffee mug

tiger shark digital clock Arctic fox bell pepper damsel�ly jersey cardigan hornbill Siberian husky soup bowl

�ly sulphur butter�ly indigo bunting chambered nautilus hummingbird jay

bulletproof vest jacamar cinema water jug bulbul

jack-o'-lantern parachute lea�hopper

red wine jelly�ish lampshade macaw stage sunglasses ant lighter

American egret matchstick screen

barn spider lemon monitor ski mask cloak obelisk mask hammerhead electric ray oscilloscope tennis ball parallel bars upright

shower wallet tape player great white shark lycaenid leaf beetle stingray crash helmet beer glass

lens cap vine snake Angora

torch notebook

binder magpie bee eater dugong dragon�ly

mortar electric guitar schooner maraca

scuba diver cabbage butter�ly

hotdog bald eagle lotion sweatshirt candle pinwheel

rule

face powder Egyptian cat ice lolly pill bottle crate

wooden spoon mitten

tabby wool broom tiger cat knot

bath towel velvet lynx

Granny Smith

spaghetti squash cheeseburger butternut squash

barrel

strawberry pick

Figure A.2: Graph representing the relation between original and perturbed labels. Note that “dominant labels” appear systematically. Please zoom for readability. Isolated nodes are removed from this visualization for readability.