{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T15:42:50Z","timestamp":1740152570679,"version":"3.37.3"},"reference-count":24,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2020,10,22]],"date-time":"2020-10-22T00:00:00Z","timestamp":1603324800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Algorithms"],"abstract":"Deep neural networks (DNNs) are vulnerable to adversarial attacks. In particular, a single perturbation known as the universal adversarial perturbation (UAP) can foil most classification tasks conducted by DNNs. Thus, different methods for generating UAPs are required to fully evaluate the vulnerability of DNNs. A realistic evaluation would be with cases that consider targeted attacks; wherein the generated UAP causes the DNN to classify an input into a specific class. However, the development of UAPs for targeted attacks has largely fallen behind that of UAPs for non-targeted attacks. Therefore, we propose a simple iterative method to generate UAPs for targeted attacks. Our method combines the simple iterative method for generating non-targeted UAPs and the fast gradient sign method for generating a targeted adversarial perturbation for an input. We applied the proposed method to state-of-the-art DNN models for image classification and proved the existence of almost imperceptible UAPs for targeted attacks; further, we demonstrated that such UAPs can be easily generated.<\/jats:p>","DOI":"10.3390\/a13110268","type":"journal-article","created":{"date-parts":[[2020,10,22]],"date-time":"2020-10-22T14:27:58Z","timestamp":1603376878000},"page":"268","source":"Crossref","is-referenced-by-count":16,"title":["Simple Iterative Method for Generating Targeted Universal Adversarial Perturbations"],"prefix":"10.3390","volume":"13","author":[{"given":"Hokuto","family":"Hirano","sequence":"first","affiliation":[{"name":"Department of Bioscience and Bioinformatics, Kyushu Institute of Technology, Iizuka, Fukuoka 820-8502, Japan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6355-1366","authenticated-orcid":false,"given":"Kazuhiro","family":"Takemoto","sequence":"additional","affiliation":[{"name":"Department of Bioscience and Bioinformatics, Kyushu Institute of Technology, Iizuka, Fukuoka 820-8502, Japan"}]}],"member":"1968","published-online":{"date-parts":[[2020,10,22]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"115","DOI":"10.1038\/nature21056","article-title":"Dermatologist-level classification of skin cancer with deep neural networks","volume":"542","author":"Esteva","year":"2017","journal-title":"Nature"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"323","DOI":"10.1016\/j.neunet.2012.02.016","article-title":"Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition","volume":"32","author":"Stallkamp","year":"2015","journal-title":"Neural Netw."},{"key":"ref_3","unstructured":"Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and harnessing adversarial examples. arXiv."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"2805","DOI":"10.1109\/TNNLS.2018.2886017","article-title":"Adversarial examples: Attacks and defenses for deep learning","volume":"30","author":"Yuan","year":"2019","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_5","unstructured":"Machado, G.R., Silva, E., and Goldschmidt, R.R. (2020). Adversarial machine learning in image classification: A survey towards the defender\u2019s perspective. arXiv."},{"key":"ref_6","unstructured":"Kurakin, A., Goodfellow, I., and Bengio, S. (2016). Adversarial examples in the physical world. arXiv."},{"key":"ref_7","unstructured":"Mohsen, S., Fawzi, A., and Frossard, P. (2016, January 27\u201330). DeepFool: A simple and accurate method to fool deep neural networks. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 22\u201326). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy, San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_9","unstructured":"Matyasko, A., and Chau, L.-P. (2018). Improved network robustness with adversary critic. arXiv."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21\u201326). Universal adversarial perturbations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref_11","unstructured":"Chaubey, A., Agrawal, N., Barnwal, K., Guliani, K.K., and Mehta, P. (2020). Universal adversarial perturbations: A survey. arXiv."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1287","DOI":"10.1126\/science.aaw4399","article-title":"Adversarial attacks on medical machine learning","volume":"363","author":"Finlayson","year":"2019","journal-title":"Science"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Khrulkov, V., and Oseledets, I. (2018, January 18\u201322). Art of singular vectors and universal adversarial perturbations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00893"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Mopuri, K.R., Ojha, U., Garg, U., and Babu, R.V. (2018, January 18\u201322). NAG: Network for adversary generation. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Salt Lake City, UT, USA.","DOI":"10.1109\/CVPR.2018.00084"},{"key":"ref_15","unstructured":"Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014, January 8\u201313). Generative adversarial nets. Proceedings of the Advances in Neural Information Processing Systems, Montreal, QC, Canada."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Kurakin, A., Goodfellow, I., Bengio, S., Dong, Y., Liao, F., Liang, M., Pang, T., Zhu, J., Hu, X., and Xie, C. (2018). Adversarial attacks and defences competition. The NIPS \u201917 Competition: Building Intelligent Systems, Springer International Publishing.","DOI":"10.1007\/978-3-319-94042-7_11"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Hayes, J., and Danezis, G. (2018, January 24). Learning universal adversarial perturbations with generative models. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.","DOI":"10.1109\/SPW.2018.00015"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","article-title":"ImageNet Large Scale Visual Recognition Challenge","volume":"115","author":"Russakovsky","year":"2015","journal-title":"Int. J. Comput. Vis."},{"key":"ref_19","unstructured":"Brown, T.B., Man\u00e9, D., Roy, A., Abadi, M., and Gilmer, J. (2017). Adversarial patch. arXiv."},{"key":"ref_20","unstructured":"Nicolae, M.-I., Sinn, M., Tran, M.N., Buesser, B., Rawat, A., Wistuba, M., Zantedeschi, V., Baracaldo, N., Chen, B., and Ludwig, H. (2018). Adversarial Robustness Toolbox v1.0.1. arXiv."},{"key":"ref_21","unstructured":"Simonyan, K., and Zisserman, A. (2015, January 7\u20139). Very deep convolutional networks for large-scale image recognition. Proceedings of the 3rd International Conference on Learning Representations (ICLR), San Diego, CA, USA."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep Residual Learning for Image Recognition. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Taghanaki, S.A., Das, A., and Hamarneh, G. (2018). Vulnerability analysis of chest X-ray image classification against adversarial attacks. Understanding and Interpreting Machine Learning in Medical Image Computing Applications, Springer.","DOI":"10.1007\/978-3-030-02628-8_10"},{"key":"ref_24","unstructured":"Morgulis, N., Kreines, A., Mendelowitz, S., and Weisglass, Y. (2019). Fooling a real car with adversarial traffic signs. arXiv."}],"container-title":["Algorithms"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-4893\/13\/11\/268\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,4]],"date-time":"2024-07-04T13:37:24Z","timestamp":1720100244000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-4893\/13\/11\/268"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,22]]},"references-count":24,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2020,11]]}},"alternative-id":["a13110268"],"URL":"https:\/\/doi.org\/10.3390\/a13110268","relation":{},"ISSN":["1999-4893"],"issn-type":[{"type":"electronic","value":"1999-4893"}],"subject":[],"published":{"date-parts":[[2020,10,22]]}}}