Analysis of dominant classes in universal adversarial perturbations

The reasons why Deep Neural Networks are susceptible to being fooled by adversarial examples remains an open discussion. Indeed, many different strategies can be employed to efficiently generate adversarial attacks, some of them relying on different theoretical justifications. Among these strategies...

Full description

Bibliographic Details
Authors: Vadillo Jueguen, Jon, Santana Hermida, Roberto, Lozano Alonso, José Antonio
Format: article
Publication Date:2022
Country:España
Institution:Universidad del País Vasco
Repository:Addi. Archivo Digital para la Docencia y la Investigación
OAI Identifier:oai:addi.ehu.eus:10810/61570
Online Access:http://hdl.handle.net/10810/61570
Access Level:Open access
Keyword:adversarial examples
universal adversarial perturbations
deep neural networks
robust speech classification
id ES_de9cfbf146b66ea15331585d60a50d7f
oai_identifier_str oai:addi.ehu.eus:10810/61570
network_acronym_str ES
network_name_str España
repository_id_str
spelling Analysis of dominant classes in universal adversarial perturbationsVadillo Jueguen, JonSantana Hermida, RobertoLozano Alonso, José Antonioadversarial examplesuniversal adversarial perturbationsdeep neural networksrobust speech classificationThe reasons why Deep Neural Networks are susceptible to being fooled by adversarial examples remains an open discussion. Indeed, many different strategies can be employed to efficiently generate adversarial attacks, some of them relying on different theoretical justifications. Among these strategies, universal (input-agnostic) perturbations are of particular interest, due to their capability to fool a network independently of the input in which the perturbation is applied. In this work, we investigate an intriguing phenomenon of universal perturbations, which has been reported previously in the literature, yet without a proven justification: universal perturbations change the predicted classes for most inputs into one particular (dominant) class, even if this behavior is not specified during the creation of the perturbation. In order to justify the cause of this phenomenon, we propose a number of hypotheses and experimentally test them using a speech command classification problem in the audio domain as a testbed. Our analyses reveal interesting properties of universal perturbations, suggest new methods to generate such attacks and provide an explanation of dominant classes, under both a geometric and a data-feature perspective.This work is supported by the Basque Government, Spain (BERC 2018–2021 program, project KK-2020/00049 through the ELKARTEK program, IT1244-19, and PRE_2019_1_0128 predoctoral grant), by the Spanish Ministry of Economy and Competitiveness MINECO, Spain (projects TIN2016-78365-R and PID2019-104966GB-I00) and by the Spanish Ministry of Science, Innovation and Universities, Spain (FPU19/03231 predoctoral grant). Jose A. Lozano acknowledges support by the Spanish Ministry of Science, Innovation and Universities, Spain through BCAM Severo Ochoa accreditation (SEV-2017-0718).Elsevier202320232022info:eu-repo/semantics/articleapplication/pdfhttp://hdl.handle.net/10810/61570reponame:Addi. Archivo Digital para la Docencia y la Investigacióninstname:Universidad del País VascoInglésinfo:eu-repo/grantAgreement/MINECO/TIN2016-78365-R/info:eu-repo/grantAgreement/MICINN/PID2019-104966GB-I00/info:eu-repo/grantAgreement/MICIU/SEV-2017-0718/https://www.sciencedirect.com/science/article/pii/S0950705121009643info:eu-repo/semantics/openAccesshttp://creativecommons.org/licenses/by/3.0/es/© 2021 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/)Atribución 3.0 Españaoai:addi.ehu.eus:10810/615702026-06-18T09:23:17Z
dc.title.none.fl_str_mv Analysis of dominant classes in universal adversarial perturbations
title Analysis of dominant classes in universal adversarial perturbations
spellingShingle Analysis of dominant classes in universal adversarial perturbations
Vadillo Jueguen, Jon
adversarial examples
universal adversarial perturbations
deep neural networks
robust speech classification
title_short Analysis of dominant classes in universal adversarial perturbations
title_full Analysis of dominant classes in universal adversarial perturbations
title_fullStr Analysis of dominant classes in universal adversarial perturbations
title_full_unstemmed Analysis of dominant classes in universal adversarial perturbations
title_sort Analysis of dominant classes in universal adversarial perturbations
dc.creator.none.fl_str_mv Vadillo Jueguen, Jon
Santana Hermida, Roberto
Lozano Alonso, José Antonio
author Vadillo Jueguen, Jon
author_facet Vadillo Jueguen, Jon
Santana Hermida, Roberto
Lozano Alonso, José Antonio
author_role author
author2 Santana Hermida, Roberto
Lozano Alonso, José Antonio
author2_role author
author
dc.subject.none.fl_str_mv adversarial examples
universal adversarial perturbations
deep neural networks
robust speech classification
topic adversarial examples
universal adversarial perturbations
deep neural networks
robust speech classification
description The reasons why Deep Neural Networks are susceptible to being fooled by adversarial examples remains an open discussion. Indeed, many different strategies can be employed to efficiently generate adversarial attacks, some of them relying on different theoretical justifications. Among these strategies, universal (input-agnostic) perturbations are of particular interest, due to their capability to fool a network independently of the input in which the perturbation is applied. In this work, we investigate an intriguing phenomenon of universal perturbations, which has been reported previously in the literature, yet without a proven justification: universal perturbations change the predicted classes for most inputs into one particular (dominant) class, even if this behavior is not specified during the creation of the perturbation. In order to justify the cause of this phenomenon, we propose a number of hypotheses and experimentally test them using a speech command classification problem in the audio domain as a testbed. Our analyses reveal interesting properties of universal perturbations, suggest new methods to generate such attacks and provide an explanation of dominant classes, under both a geometric and a data-feature perspective.
publishDate 2022
dc.date.none.fl_str_mv 2022
2023
2023
dc.type.none.fl_str_mv info:eu-repo/semantics/article
format article
dc.identifier.none.fl_str_mv http://hdl.handle.net/10810/61570
url http://hdl.handle.net/10810/61570
dc.language.none.fl_str_mv Inglés
language_invalid_str_mv Inglés
dc.relation.none.fl_str_mv info:eu-repo/grantAgreement/MINECO/TIN2016-78365-R/
info:eu-repo/grantAgreement/MICINN/PID2019-104966GB-I00/
info:eu-repo/grantAgreement/MICIU/SEV-2017-0718/
https://www.sciencedirect.com/science/article/pii/S0950705121009643
dc.rights.none.fl_str_mv info:eu-repo/semantics/openAccess
http://creativecommons.org/licenses/by/3.0/es/
Atribución 3.0 España
eu_rights_str_mv openAccess
rights_invalid_str_mv http://creativecommons.org/licenses/by/3.0/es/
Atribución 3.0 España
dc.format.none.fl_str_mv application/pdf
dc.publisher.none.fl_str_mv Elsevier
publisher.none.fl_str_mv Elsevier
dc.source.none.fl_str_mv reponame:Addi. Archivo Digital para la Docencia y la Investigación
instname:Universidad del País Vasco
instname_str Universidad del País Vasco
reponame_str Addi. Archivo Digital para la Docencia y la Investigación
collection Addi. Archivo Digital para la Docencia y la Investigación
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869421990284099584
score 15,300719

Similar Items