Signal Processing - November 2017 - 55

ture important security and reliability properties of classifiers,
and 3) they show important properties on the geometry of the
decision boundary of the classifier.
In [22], deep networks are shown to be surprisingly vulnerable to universal (image-agnostic) perturbations. Specifically,
a universal perturbation v can be defined as the minimal perturbation that fools a large fraction of the data points sampled
from the data distribution n , i.e.,

forms of complex perturbations is tested, and state-of-the-art
deep networks are shown once again to be unstable to these
perturbations. An empirical analysis of the ability of current convolutional neural networks (CNNs) to manage location and scale variability is proposed in [21]. It is shown, in
particular, that CNNs are not very effective in factoring out
location and scale variability, despite the popular belief that
the convolutional architecture and the local spatial pooling
provides invariance to such representations. The aforementioned works show that, just as state-of-the-art deep neural networks have been observed to be unstable to additive
unstructured perturbations, such modern classifiers are not
robust to perturbations even when severely restricting the set
of possible transformations of the image.

	 v = argmin r

p

r

subject to xP~ ( f (x + r) ! f (x)) $ 1 - e, (8)
n

where e controls the fooling rate of the universal perturbation. Unlike adversarial perturbations that target to fool a
specific data point, universal perturbations attempt to fool
most images sampled from the natural images distribution n. Specifically, by adding this single (image-agnostic)
perturbation to a natural image, the label estimated by the
deep neural network will be changed with high probability.
In [22], an algorithm is provided to compute such universal perturbations; these perturbations are further shown to
be quasi-imperceptible while fooling state-of-the-art deep
networks on unseen natural images with probability edging 80%. Specifically, the , p norm of these perturbations
is at least one order of magnitude smaller than the norm of
natural images but causes most perturbed images to be misclassified. Figure 3 illustrates examples of scaled -universal

Universal additive perturbations
All of the previous definitions capture different forms of
robustness, but they all rely on the computation of data-specific perturbations. Specifically, they consider the necessary
change that should be applied to specific samples to change the
decision of the classifier. More generally, one might be interested to understand if classifiers are also vulnerable to generic
(data and network agnostic) perturbations. The analysis of the
robustness to such perturbations is interesting from several
perspectives: 1) these perturbations might not require the precise knowledge of the classifier under test, 2) they might cap-

(a)

(b)

(c)

(d)

(e)

(f)

FIGURE 3. Universal perturbations computed for different deep neural network architectures. The pixel values are scaled for visibility. (a) CaffeNet,
(b) VGG-F, (c) VGG-16, (d) VGG-19, (e) GoogLeNet, and (f) ResNet-152.

IEEE SIGNAL PROCESSING MAGAZINE

|

November 2017

|

55
Table of Contents for the Digital Edition of Signal Processing - November 2017
