.,, ().
 ---
abstract: 'Given a state-of-the-art deep neural network classifier, we show the existence of a (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable to such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze these universal perturbations and show, in particular, that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important geometric *correlations* among the high-dimensional decision boundary of classifiers. It further outlines potential security breaches with the existence of single directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.[^1]'
author:
- |
    Seyed-Mohsen Moosavi-Dezfooli[^2][^3]\
    [seyed.moosavi@epfl.ch]{}
- |
    Alhussein Fawzi\
    [alhussein.fawzi@epfl.ch]{}
- '\'
- |
    Omar Fawzi[^4]\
    [omar.fawzi@ens-lyon.fr]{}
- |
    Pascal Frossard\
    [pascal.frossard@epfl.ch]{}
bibliography:
- 'bibliography.bib'
title: Universal adversarial perturbations
---

Acknowledgments {#acknowledgments.unnumbered}
---------------

We gratefully acknowledge the support of NVIDIA Corporation with the donation of the Tesla K40 GPU used for this research.

[^1]: To encourage reproducible research, the code is available at [gitHub](https://github.com/LTS4/universal). Furthermore, a video demonstrating the effect of universal perturbations on a smartphone can be found [here](https://youtu.be/jhOu5yhe0rc).

[^2]: The first two authors contributed equally to this work.

[^3]: École Polytechnique Fédérale de Lausanne, Switzerland

[^4]: ENS de Lyon, LIP, UMR 5668 ENS Lyon - CNRS - UCBL - INRIA, Université de Lyon, France
 ---
abstract: 'We derive expressions for the leading-
., , (). 
  --- 
 abstract:' Given a state - of - the - art deep nervous net classifier, we indicate the existence of a (image - agnostic) and very little perturbation vector that causes lifelike images to be misclassified with high probability. We propose a taxonomic algorithm for calculate universal perturbations, and express that state - of - the - art deep nervous networks are highly vulnerable to such perturbations, albeit being quasi - imperceptible to the human center. We further empirically analyze these cosmopolitan perturbation and show, in particular, that they generalize very well across nervous networks. The surprising existence of universal perturbations reveals significant geometric * correlations * among the high - dimensional decision boundary of classifiers. It far outlines potential security breaches with the existence of individual directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.[^1 ]' 
 author: 
 - | 
     Seyed - Mohsen Moosavi - Dezfooli[^2][^3]\ 
     [ seyed.moosavi@epfl.ch ] { } 
 - | 
     Alhussein Fawzi\ 
     [ alhussein.fawzi@epfl.ch ] { } 
 -' \' 
 - | 
     Omar Fawzi[^4]\ 
     [ omar.fawzi@ens-lyon.fr ] { } 
 - | 
     Pascal Frossard\ 
     [ pascal.frossard@epfl.ch ] { } 
 bibliography: 
 -' bibliography.bib' 
 title: cosmopolitan adversarial disturbance 
 --- 

 Acknowledgments { # acknowledgments.unnumbered } 
 --------------- 

 We thankfully admit the support of NVIDIA Corporation with the donation of the Tesla K40 GPU used for this inquiry. 

 [ ^1 ]: To encourage reproducible inquiry, the code is available at [ gitHub](https://github.com / LTS4 / universal). Furthermore, a video demonstrating the consequence of universal perturbations on a smartphone can be found [ here](https://youtu.be / jhOu5yhe0rc). 

 [ ^2 ]: The first two authors contributed equally to this work. 

 [ ^3 ]: École Polytechnique Fédérale de Lausanne, Switzerland 

 [ ^4 ]: ENS de Lyon, LIP, UMR 5668 ENS Lyon - CNRS - UCBL - INRIA, Université de Lyon, France 
  --- 
 abstract:' We derive expressions for the leading-
.,, ().
 ---
ahstract: 'Given a state-of-tme-art deep neural netwock clasaifier, wd show the existence of a (imege-atnostuc) and very small pertjrbation nector thqt ceuses natural imefes to nz misdpassnfmed with high ptobability. Wa propose a syvtdmctic algorithm for computing universwl pertirhations, and shjw tnwt sfate-of-the-art deep neural networks zre higily vulnerable yo such perturbations, albelt bfing quasi-impercephible to thg huiqn eye. We fufther empigncally analize these universal perturbationr and show, in pqrricknar, that thxy genvralize very well acrmss neutal networks. Tme sucpriwing existence of unitersal perturbations reveals hm'ortant geometric *coreeoatiots* akong rhe hifh-vimsnsionwl vecision bohndary of coassifiers. It furthtr jlylines potenfial sqctrity breaches with the existence of sitgls directions in the inpyt space that adversaties can pjssibly exploit to break a classifier on most natgral mmxgew.[^1]'
amthof:
- |
    Seyed-Mohsen Moosavi-Dezfooli[^2][^3]\
    [seyed.moosavy@spgl.bh]{}
- |
    Alhussein Nawzi\
    [alhussein.gaazo@gpfl.ch]{}
- '\'
- |
    Omxr Fawvj[^4]\
    [omar.fawzi@ens-lyoj.fr]{}
- |
    Pascql Frossawd\
    [pascal.frossard@epfl.ch]{}
bibliigraphy:
- 'biblpogrqphy.bib'
title: Univexsal adversaxial pgrturbstions
---

Acknowledgments {#aeknowlsdgments.unnkmbered}
---------------

We eratefully acknodlecga the sukoort of NVIDIA Cowporation witk the dovatipn of ehe Tesla N40 GPU used for this resewrch.

[^1]: Jo encmurage repgoducible research, the code is etailable at [gotVub](vttps://gitkub.com/KTS4/universal). Surthermore, a rideo deionstfating the effect of universwl perturbatimjs on a smarvphone cag be foubd [here](fgtps://youtu.be/jhOi5yhe0rc).

[^2]: Thv yirst two authors contributcd eqoamly to this worj.

[^3]: Écile Polytechniqie Wédérwlv dx Laufdnne, Switzernand

[^4]: ENR de Lhon, LIP, UMR 5668 ENS Lyon - CNRS - UCBL - ITRIA, Université de Lyon, Fvance
 ---
absjract: 'We qerive expresxions for the leadlng-
.,, (). --- abstract: 'Given a state-of-the-art network we show existence of a vector causes natural images be misclassified with probability. We propose a systematic algorithm computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze universal and in that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important *correlations* among the high-dimensional decision boundary of classifiers. further outlines potential security with the existence of single in input space adversaries possibly to break a on most natural images.[^1]' author: - | Seyed-Mohsen Moosavi-Dezfooli[^2][^3]\ [seyed.moosavi@epfl.ch]{} - | Alhussein Fawzi\ [alhussein.fawzi@epfl.ch]{} - '\' | Omar - | Frossard\ bibliography: 'bibliography.bib' title: Universal --- Acknowledgments {#acknowledgments.unnumbered} --------------- We gratefully of NVIDIA Corporation with the donation of the K40 GPU for this research. [^1]: To encourage research, the code is available at [gitHub](https://github.com/LTS4/universal). Furthermore, video demonstrating the effect of universal perturbations on a smartphone can be found [here](https://youtu.be/jhOu5yhe0rc). [^2]: two authors contributed equally this work. [^3]: Polytechnique de Switzerland ENS de LIP, UMR 5668 ENS Lyon - CNRS - UCBL - INRIA, de Lyon, France --- abstract: 'We derive expressions for the
.,, ().
 ---
abstract: 'Given a state-of-the-aRt deep neurAl netWorK clAsSifiEr, we Show the existenCE of a (Image-agnostic) and very smAll peRtURbatIOn VectoR that caUSeS NAtuRaL iMagEs TO bE miscLasSified wIth high proBabIlIty. We propose A SyStematic alGorIthm for compuTinG univeRsAl pERturbAtiOns, anD show tHAt statE-of-the-art DeEP neuraL NetworkS ARe HighLy vulnerable to sucH PeRTurbations, albeIt beinG qUAsI-IMpeRcePtible to thE hUman eYE. We furtHEr EMPIriCAlly analyze thEse universaL PerTurbatIoNs aND show, iN partIcULar, That they genEralIze very weLl acroSS neural NEtworks. the surPriSinG exiSTeNcE of UnIVerSAl PerTUrbAtions reVeAlS impoRtanT GEOMetrIc *cOrreLatioNs* among the higH-diMensIOnaL deciSion bOundArY of clAssifiErs. It FuRther outlines poTentIal securiTy bReAchEs With tHE existEncE of Single dIrectioNS in ThE INPuT space that adversarIeS CAn Possibly ExploiT To BrEAk a classIfIer On moST NaturAl imAGeS.[^1]'
author:
- |
    SEyed-MoHSeN MOosavi-DEzFooli[^2][^3]\
    [sEyEd.mOosAvi@epFL.ch]{}
- |
    ALhusseIn Fawzi\
    [aLhussEIn.fawzi@epfl.ch]{}
- '\'
- |
    OMAr Fawzi[^4]\
    [omar.faWZi@ENS-lYOn.fr]{}
- |
    pasCal Frossard\
    [PascAL.froSsarD@EpFl.cH]{}
BibliOgrapHy:
- 'BIbLIography.bib'
title: UniVeRsal adVersaRial perturbatIons
---

AcknowLEDGments {#acKnowLEdGMents.unnumbereD}
---------------

We grAtefully acKNowledge The suPport of NvIDIA CorpORAtion witH thE doNatIon OF ThE Tesla K40 GPU useD FOr thIs ResearcH.

[^1]: To EncouraGe rEprOduCibLe Research, tHe code is AvAiLaBlE at [GitHuB](Https://gitHuB.coM/LtS4/uNiverSAl). FurtHermoRe, a vIdEo DEmoNstratiNG tHE EffeCt Of UnivErsAl PertuRbatIOns On a smarTphone can Be fOUnd [hErE](hTtps://youTu.be/jhOu5yhe0rc).

[^2]: thE first two aUtHorS contrIBUted equaLly to this work.

[^3]: École PolytEChnique fédÉrale De LaUsanne, SwiTzeRland

[^4]: EnS dE lyon, LIp, UMR 5668 ENs Lyon - cNrS - Ucbl - INRIa, uNiVerSiTé de Lyon, FrANCe
 ---
aBstraCt: 'we deRive expRessions for the leadINg-
.,, ().
 ---
abstract: 'Gi ven a stat e-of- the -ar tdeep  neu ral network cl a ssif ier, we show the exist enceof a (i m ag e-agn ostic)a nd v ery  s ma llpe r tu rbati onvectorthat cause s n at ural imagest obe misclas sif ied with hig h p robabi li ty. We pr opo se asystem a tic al gorithm f or comput i ng univ e r sa l pe rturbations, ands ho w  that state-of -the-a rt de e p  ne ura l networks  a re hi g hly vul n er a b l e t o  such perturb ations, alb e itbeingqu asi - imperc eptib le tothe human e ye.We furthe r empi r icallya nalyzetheseuni ver salp er tu rba ti o nsa nd  sh o w,in parti cu la r, th at t h e y gene ral izeverywell across n eur al n e two rks.The s urpr is ing e xisten ce of  u niversal pertur bati ons revea lsim por ta nt ge o metric  *c orr elation s* amon g  th eh i g h- dimensional decisi on b ou ndary of  class i fi er s . It fur th eroutl i n es po tent i al  securit y brea c he swith th eexiste nc e o f s ingle dire ctions  in theinput space that adv e rsaries can p o ss i b ly expl oit  to break a  cla s sifi er o n  m ost natur al im ag e s. [ ^1]'
author:
- |
  Seyed- Mohse n Moosavi-Dez fooli[^2][ ^ 3 ] \
    [s eyed . mo o savi@epfl.ch]{ }
- | 
    Alhus s ein Fawz i\
   [alhus sein.fawz i @ epfl.ch] {}- ' \'- |   Omar Fawzi[^ 4 ] \
  [omar.f awz i@ens-l yon .fr ]{} 
-|    Pasca l Frossa rd \  [pa scal. f rossard@ ep fl. ch ]{} 
bibl i ograph y:
-'bib li og r aph y.bib't it l e : Un iv er saladv er saria l pe r tur bations 
---

Ack now l edgm en ts  {#ackn owledgments.u nn umbered}
- -- --- ------ - - -

We gr atefully acknowledge th e  suppor t o f NVI DIACorporati onwith t hed onatio n of t he Te sl a K 4 0  GPUu s ed  fo rthis resea r c h.
[^1] :To e ncourag e reproducible res e arc h, the code i s a vail a b le  at [g i tHu b] ( htt p s ://github.com/L TS4/univer sa l ).  Furthermo r e,avideo d emonstr ating the eff ect of un iversal p er turb a t ion s on a sma rtphonecan be fo u nd [h e re ](htt ps: //yout u. be/ jhOu5 yhe0rc ) .
[^2]:  The f ir st two  auth or s contri buted equally to this w ork.
[^3]:  Éc ole Polyt ech n iqu e Fédéral e de  Lausanne,  Sw itz erlan d
[ ^4]:ENSd eLyo n , LIP , UM R  5668 ENS Ly on- CN RS - UCBL - I N RIA , Uni ver s ité de  Lyo n, France
 ---
ab s tract: 'We der ivee x pre ssi o ns f or  the leading-
.,, ().
_---
abstract: 'Given_a state-of-the-art deep neural_network classifier,_we_show the_existence_of a (image-agnostic)_and very small_perturbation vector that causes_natural images to_be_misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and_show_that state-of-the-art_deep_neural_networks are highly vulnerable to_such perturbations, albeit being quasi-imperceptible_to the_human eye. We further empirically analyze these universal_perturbations_and show, in_particular, that they generalize very well across neural networks._The surprising existence of universal perturbations_reveals important geometric_*correlations*_among_the high-dimensional decision boundary_of classifiers. It further outlines potential_security breaches with the existence of_single directions in the input space that_adversaries can possibly exploit to break_a classifier on most natural_images.[^1]'
author:
- |
_   Seyed-Mohsen Moosavi-Dezfooli[^2][^3]\
_  _[seyed.moosavi@epfl.ch]{}
- |
_  _Alhussein Fawzi\
    [alhussein.fawzi@epfl.ch]{}
-_'\'
- |
 _  Omar Fawzi[^4]\
  __[omar.fawzi@ens-lyon.fr]{}
- |
 ___Pascal Frossard\
_  _[pascal.frossard@epfl.ch]{}
bibliography:
-_'bibliography.bib'
title: Universal_adversarial_perturbations
---

Acknowledgments {#acknowledgments.unnumbered}
---------------

We gratefully acknowledge the support_of_NVIDIA Corporation with the donation of the_Tesla K40 GPU used_for_this research.

[^1]: To encourage_reproducible research, the code is_available at [gitHub](https://github.com/LTS4/universal). Furthermore, a video_demonstrating the_effect of_universal perturbations on a smartphone can be found [here](https://youtu.be/jhOu5yhe0rc).

[^2]: The first_two authors contributed equally to this_work.

[^3]: École Polytechnique Fédérale_de Lausanne,_Switzerland

[^4]:_ENS de Lyon,_LIP,_UMR 5668_ENS Lyon - CNRS - UCBL -_INRIA, Université_de Lyon, France
 ---
abstract: 'We derive_expressions for the leading-