Analysis of Dominant Classes in Universal Adversarial Perturbations
The reasons why Deep Neural Networks are susceptible to being fooled by adversarial examples remains an open discussion. Indeed, many differ- ent strategies can be employed to efficiently generate adversarial attacks, some of them relying on different theoretical justifications. Among these strategi...
| Authors: | , , |
|---|---|
| Format: | article |
| Status: | Published version |
| Publication Date: | 2022 |
| Country: | España |
| Institution: | Basque Center for Applied Mathematics (BCAM) |
| Repository: | BIRD. BCAM's Institutional Repository Data |
| OAI Identifier: | oai:bird.bcamath.org:20.500.11824/1460 |
| Online Access: | http://hdl.handle.net/20.500.11824/1460 |
| Access Level: | Open access |
| Keyword: | Adversarial examples Universal Adversarial Perturbations Deep Neural Networks Robust Speech Classification |
| Summary: | The reasons why Deep Neural Networks are susceptible to being fooled by adversarial examples remains an open discussion. Indeed, many differ- ent strategies can be employed to efficiently generate adversarial attacks, some of them relying on different theoretical justifications. Among these strategies, universal (input-agnostic) perturbations are of particular inter- est, due to their capability to fool a network independently of the input in which the perturbation is applied. In this work, we investigate an in- triguing phenomenon of universal perturbations, which has been reported previously in the literature, yet without a proven justification: universal perturbations change the predicted classes for most inputs into one par- ticular (dominant) class, even if this behavior is not specified during the creation of the perturbation. In order to justify the cause of this phe- nomenon, we propose a number of hypotheses and experimentally test them using a speech command classification problem in the audio domain as a testbed. Our analyses reveal interesting properties of universal per- turbations, suggest new methods to generate such attacks and provide an explanation of dominant classes, under both a geometric and a data- feature perspective. |
|---|