Title: CRAFTING DATA-FREE UNIVERSAL ADVERSARIES WITH DILATE LOSS

Abstract: We introduce a method to create Universal Adversarial Perturbations (UAP) for a given CNN in a data-free manner. Data-free approaches suite scenarios where the original training data is unavailable for crafting adversaries. We show that the adversary generation with full training data can be approximated to a formulation without data. This is realized through a sequential optimization of the adversarial perturbation with the proposed dilate loss. Dilate loss basically maximizes the Euclidean norm of the output before nonlinearity at any layer. By doing so, the perturbation constrains the ReLU activation function at every layer to act roughly linear for data points and thus eliminate the dependency on data for crafting UAPs. Extensive experiments demonstrate that our method not only has theoretical support, but achieves higher fooling rate than the existing data-free work. Furthermore, we evidence improvement in limited data cases as well.

1. INTRODUCTION:

Despite the phenomenal success of deep neural networks in many practical applications, adversarial attacks are being a constant plague. These attacks corrupt the input with a small and usually imperceptible structured noise causing the model to output incorrect predictions. The sole existence of such a vulnerability not only raises concerns about the security of deep learning models, but also questions the robustness of the learned representations. To make it further worse, it has been shown that a single noise, called universal adversarial perturbation (UAP), can be added to any image and fool the network. UAPs do not require any optimization on the input image at attack time, but the corruption effectively works for most of the images. Interestingly, such perturbations created for one model exhibit transferability of attack and induce high fooling on other models. One drawback of UAPs though, is the requirement of training data for crafting perturbations. This is increasingly infeasible as the datasets are becoming quite large and might not be publicly released due to privacy or copyright reasons. In such cases where the original data is not available, data-free methods are gaining traction. In the data-free setting, the perturbation is created only with the trained neural network. Such methods typically rely on the trained weights and the CNN structure to find vulnerable patterns that can maximally disturb the normal propagation of activations across the network. A higher transfer of attack across networks is observed for data-free UAPs as well, raising its practical utility. Moreover, the study of these perturbations might lead to new insights on how deep neural networks actually work.

In this paper, we propose a new method for crafting data-free UAPs for any given CNN using ReLU nonlinearity. The approach relies on finding the singular vectors of a linearly approximated network (Section 3.1). A loss formulation is devised to enable this approximation under certain conditions. Dilate loss forms the major component of the method, which generates a perturbation that maximizes the Euclidean norm of the activation vector (before the nonlinearity) at a given layer (Section 3.2). We show that the perturbation crafted through dilation has the effect of linearly approximating the ReLU layer responses for any data points. These dilations are done sequentially for all the layers from the input to the last classification stage (Section 3.3). We argue that the sequential dilations results in a perturbation that aligns with the first singular vector of the linearly approximated network. Our approach outperforms the existing data-free method in fooling rates and the evaluation is also done for less data scenarios (Section 4).

In summary, the work contributes the following: • A new method that can create universal adversarial perturbation without using data and achieve state-of-the-art data-free fooling rates. • A detailed theoretical analysis which formulates the proposed sequential dilation algorithm by approximating the adversary generation with full training data under certain conditions.

2. RELATED WORK:

The vulnerability of deep neural networks to adversarial samples is first shown in Szegedy et al. (2013) . Following Szegedy et al. (2013) , several methods (Goodfellow et al., 2014; Kurakin et al., 2016; Dong et al., 2018; Madry et al., 2017; Moosavi-Dezfooli et al., 2016; Brendel et al., 2017; Athalye et al., 2018; Carlini & Wagner, 2017) are being proposed to craft such adversarial samples. One of the simplest method is the Fast Gradient Sign Method (FGSM) formulated in Goodfellow et al. (2014) . FGSM obtains the perturbation by single step gradient ascent of the loss function with respect to the input image. There are multi step variants to FGSM like iterative FGSM (Kurakin et al., 2016) , Momentum (Dong et al., 2018) , Projected Gradient Descent (PGD) (Madry et al., 2017) , Deepfool (Moosavi-Dezfooli et al., 2016) , etc. These attacks are image-specific, where the perturbation is a function of the input and requires a separate optimization for each image. -Dezfooli et al. (2017) introduce the idea of Universal Adversarial Perturbations (UAP), a single perturbation that can fool the model for most of the input images. UAP is obtained by jointly maximizing the training loss for dataset images. There are also generative approaches like NAG (Reddy Mopuri et al., 2018b) , AAA (Reddy Mopuri et al., 2018a) , GAP (Poursaeed et al., 2018) for crafting universal adversaries. Khrulkov & Oseledets (2018) propose a method based on singular vectors of Jacobian matrix to create universal adversaries. They show impressive fooling performance with a very small set of training images, but the method is not data-free. Though the study of adversarial attacks started with the classification task, there are several works (Xie et al., 2017; Metzen et al., 2017) that extend such attacks to other tasks like segmentation, detection, etc. Further, adversarial examples are shown to generalize to the physical world in Kurakin et al. (2016) . While most attacks changes each pixel in the image with small imperceptible noise, there are methods (Sharif et al., 2016; Brown et al., 2017; Papernot et al., 2016) that perturb limited number of pixels with large noise as these are more practical in nature.

Moosavi:

The attacks discussed so far, in general, rely on maximizing the training loss. In contrast, Mopuri et al. (2018) devise a generalizable data-free objective for crafting UAPs (GDUAP). GDUAP maximizes the activations at the output of all convolutional layers corrupting the feature representations learned and hence fooling the model. Our method has similarity to GDUAP, but with the crucial difference that the Euclidean norm maximization is performed before the nonlinearity in our case. Further, we maximize the norms of the layers one after the other in a sequential fashion as opposed to a single joint optimization. We show theoretically and experimentally that these changes cause a lot of difference in fooling performance. Moreover, no sound reasoning is available in Mopuri et al. (2018) to justify the formulation, whereas we provide theoretical explanation for the algorithm.

3. OUR APPROACH:



3.1. CRAFTING A DATA-FREE OBJECTIVE:

Consider a deep neural network with L layers already trained for classification task. We assume the activation function employed in the network to be ReLU (Nair & Hinton, 2010) , defined as

σ R (x) = x if x > 0 0 otherwise,

which basically zeros out all negative elements and retains the positive ones when applied on a matrix. Let

f 1 (x) = W 1 x, f 2 (x) = W 2 σ R (W 1 x), ..., f l (x) = W l σ R (. . . W 2 σ R (W 1 x) . . .)

be the outputs at different layers of the network for an input vector x. Note that the output f i for the ith layer is taken before the nonlinearity and f L represents the pre-softmax neuron layer. We ignore the bias terms for mathematical simplicity. The weights (W i s) of the network are trained with input and label pairs from the dataset D.

Our aim is to craft a perturbation vector p with Euclidean norm c such that the network incorrectly classifies for most of the data samples. Mathematically, the optimization can be written as,

EQUATION

where σ S is the softmax function. Note that the condition for the indicator function (I) that checks for misclassification is dependent on the ground truth labels (y i s). Assuming a high classification accuracy for the model, we approximate the condition to argmax(σ

S (f L (x i + p))) = argmax(σ S (f L (x i )))

. Since softmax function is monotonic, we further relax the objective 1 to

EQUATION

which amounts to finding a p that maximizes the network response after being added to the inputs.

In other words, p should maximally disturb the output f L for all data points. Note that for some x i s, maximizing |f L (x i + p) -f L (x i )| 2 might not result in incorrect prediction. We assume such cases to be minority and the objective could lead to significant adversarial changes to f L responses for majority input samples. If X = {x 0 , x 1 , . . . , x N } denote the matrix formed by the assembling all the N data samples as columns and 1 represent a column vector of ones of appropriate size, then the optimization 2 can be rewritten as,

EQUATION

We recognize that optimization 3 is not exactly equivalent to the original objective 1, but is an approximation which does not require the ground truth labels. But still the training data X is essential for computation and needs to be eliminated for a complete data-free approach. Now observe that if f L were to be a linear function, then the objective 3 reduces to, max

EQUATION

which means that p has to align along the first right singular vector of the linear f L map. The singular p could potentially disturb the output f L more for all the x i s than any other vector. Interestingly, note that the optimization 4 is a data-free objective under the linear assumption of f L . However, f L is nonlinear due to the presence of ReLU activation functions at every layer. Note that the formulation 4 is valid even if f L is not a complete linear map, but satisfies

f L (X + p1 T ) = f L (X) + f L (p1 T )

for some p. Hence, we devise an algorithm to seek a perturbation that can approximately induce the above additivity property to the ReLU network.

3.2. LINEARLY APPROXIMATING THE NETWORK:

We start by noting that the only nonlinearity in the network is due to the ReLU activation function at every layer. But ReLU is piece-wise linear; especially, observe that σ R (a

+ b) = σ R (a) + σ R (b)

if vectors a and b are in the same orthant. Now consider the ReLU nonlinearity after the first layer, σ R (W 1 X + W 1 p1 T ), which becomes additive if column vectors in W 1 X are in the same orthant as W 1 p. We relax this criteria and favour the case of making the vectors as close as possible by,

EQUATION

where x1 stands for the mean of the N data samples in X. The solution of the optimization 5 is expected to minimize the error due to the additive approximation of the layer. In order to eliminate the data term from the objective, we make an assumption that the first singular vector of the weight matrices align along the mean vector of its corresponding input. In other words, the dot product of data mean x1 with the singular vectors of W 1 is maximum for the first singular vector. Now we use the following lemma to argue that the objective 5 is maximum when p aligns with the first singular vector of W 1 (proof available in Appendix A). Lemma 1. If x has positive and larger scalar projection on the first singular vector of W than remaining singular vectors, then argmax

p xW T W p = argmax p |W p| 2 subject to |p| = c.

Hence, the optimization problem 5 is equivalent to, max

EQUATION

which we call as the dilation of the first layer. We justify the assumption based on the premise that the singular vectors of the weights must have captured the discriminatory modes of data samples while training. By discriminatory mode we refer to the components of X that are essential for the classification task and most likely extracted by the hierarchy of weights in the network. These does not correspond to the modes of variation of data points. The assumption essentially means that the first singular vector carries the most important features common to most of the data points than the remaining singular directions. This is taken to be valid for any layer weight W l with difference that the mean vector xl is averaged over the layer l -1 output, i.e. xl = (1/N )σ R (f l-1 (X))1 for l > 1.

Now consider the second layer of the network given by σ R (W

2 σ R (W 1 X + W 1 p1 T ))

, where there are two ReLU functions in action. Suppose the first ReLU function is linearly approximated with dilation objective 6. Consequently, the second layer output can be written as σ R (W

2 σ R (W 1 X) + W 2 σ R (W 1 p1 T )).

Note that the second ReLU can be linearly approximated if column vectors in

W 2 σ R (W 1 X) are close to W 2 σ R (W 1 p).

Considering the two approximations, we formulate the optimization as,

EQUATION

EQUATION

Again, we leverage the assumption that the data mean projects more to the first singular vector of the weight matrix and with Lemma 1, the problem becomes the dilation of the second layer, max

EQUATION

)

We extend the same arguments to further layers and see that the dilations tends to make the network layers approximately additive with respect to the generated perturbation vector. For the last layer, the dilation terms are added to objective 4 to account for the errors introduced due to linear approximation of all the ReLU layers. Hence, the final optimization problem for UAP generation becomes, max

EQUATION

)

which is clearly a completely data-free formulation.

3.3. SEQUENTIAL DILATION ALGORITHM:

We leverage the theoretical intuitions from the previous Section to formulate an algorithm for UAP generation in a data-free manner. Note that the direct implementation of optimization 10 through any gradient descent algorithm would lead to sub-optimal solutions as the chances of getting stuck Algorithm 1: The sequential dilation algorithm for crafting data-free UAPs. The input is the multi-layer neural network f and the perturbation strength c. A set of adversarial perturbations {p l } L l=1 , one for each layer, is returned as the output. Note that λ is the learning rate. p 0 ∼ U(-10, 10) for l = {1, 2, . . . , L} do p l = p l-1 while convergence do

p l = p l + λ∇ p l l i=1 log(|f i (p l )| 2 ) Set |p l | ∞ = c end end

in local minimas is high. This is especially true since no data is used and the only variable being optimized is p with no sources of randomness. Hence, we perform the dilations of optimization 10 in sequential manner so as to avoid chances of reaching local minima solutions. Some more changes are applied in the way the original optimization is implemented, mainly for training stability and to compare fairly with existing methods. For numerical stability of the optimization, we follow Mopuri et al. ( 2018) and maximize logarithm of the Euclidean norm in the dilate loss. In order to compare with existing methods, l ∞ norm is restricted instead of the l 2 in the problem 10. This constrains the maximum of absolute value of the adversarial noise.

Algorithm 1 elucidates our proposed sequential dilation algorithm for ReLU based neural networks. The procedure loops over all the layers of the network. For the first layer, we find a vector p 1 which maximizes the logarithm of l 2 norm of W 1 p 1 , essentially finding the first singular vector of W 1 . After the dilation of the first layer, the perturbation p 1 is used as an initialization for maximizing the Euclidean norm of second layer. But note the first loss term |W 1 p| 2 2 is still kept in the dilation of second layer. This loss formulation tries to maximize the norm of output at the current layer along with all the previous layers that feed into it. In short, dilation of lth layer starts the optimization with perturbation obtained from dilation of (l -1)th layer and involves the joint dilation of all l layers. The method runs till the softmax layer of the network and the final perturbation p L is a UAP, created without using any training data and could potentially fool majority of input samples.

We only consider CNNs trained for classification task. The optimization is performed using standard ADAM optimizer (Kingma & Ba, 2014) with a fixed learning rate schedule till the training loss saturates. Typical learning rate is 0.1. At every step of the optimization, the values of the perturbation are clipped to limit the allowed range. The l ∞ norm is set as 10 for all our experiments. Although, Euclidean and maximum norms are not theoretically equivalent, practically we observe that the final perturbations are saturated, with roughly more than 78% of the values reaching ±10. This implies the l 2 norm also to be approximately restricted under the saturation assumption. Once the perturbation gets saturated while optimization, the loss might saturate and could be stuck in local minimas.

VGG-16 VGG-19:

ResNet-50

ResNet-152 Inception-v1 Inception-v3:

Figure 2 : Data-free Universal Adversaries crafted using our sequential dilation algorithm.

Table 1 : Comparison of fooling rates (in percentage) obtained for our approach with that of other works. We achieve higher fooling rate than the existing data-free method GDUAP (Mopuri et al., 2018) . Note that UAP (Moosavi-Dezfooli et al., 2017) To prevent this, after dilation at every layer, we rescale the perturbation by dividing the pixel values by 2. This does not make any difference to the procedure as only the magnitude is changed to make room for further optimization. Ideally, we should do sequential dilations for all the convolutional and fully connected layers of the CNN from input side to the end softmax classifier. But for very deep models like Inception and ResNet, the dilations are done only for every architectural blocks.

Because of this the optimization might be more nonlinear than what is being assumed in Section 3.1, with the maximum norm further inducing the clipping nonlinearity. Hence, we initialize the perturbation (p 0 ) with the values drawn randomly from a uniform distribution U(-10, 10). Finally, note that absolutely no data in any form is used for creating adversarial noise, not even a validation set is employed in contrast to Mopuri et al. (2018) . The code for our approach is available for review at the anonymous link https://github.com/anoniclr/uap seq dilate.

4. EXPERIMENTS:

We benchmark our proposed sequential dilation method with the existing data-free approaches. All the experiments are performed on popular classification models like VGG (Simonyan & Zisserman, 2014) , ResNet (He et al., 2016) and Inception (Szegedy et al., 2016) . These models are already trained on Imagenet (Deng et al., 2009) dataset and delivers very high classification accuracy. Figure 2 shows the perturbations crafted using the proposed method for various networks. We follow other works (Moosavi-Dezfooli et al., 2017; Mopuri et al., 2018) and assess the performance of our adversarial attack using the fooling rate metric. Fooling rate is defined as the fraction of test images on which the network prediction differs before and after the addition of the adversarial noise. Table 1 reports the fooling rates obtained by our method along with that of other works. The first comparison is with the random baseline, which is the fooling incurred with just random noise. Second baseline is with the only existing data-free approach GDUAP. Clearly, our proposed data-free objective achieves significantly higher fooling rates than the other data-free work. This indicates that sequential dilation algorithm, not only has theoretical backing, but also results in higher fooling rates in practice. Note that we have run our method ten times and the results produced in the table are mean fooling rate along with the standard deviation, to statistically validate the performance improvement.

Now we ablate the different aspects of the sequential dilation algorithm to demonstrate the usefulness of the design choices. experiment is non-sequential version of dilation, listed as single dilation in the table. This is a single joint optimization maximizing the norm of activations before the non-linearity. PSM maximization refers to simple maximization of the pre-softmax layer (f L ) alone, which is same as the approximated objective 4. As described in Section 3.3, our dilation of a layer involves keeping the maximization terms of all the previous layers. We empirically validate the necessity of such a scheme by just sequentially maximizing the layer norms without the cumulative loss term for the experiment Ours without accumulation in Table 2 . Note that each maximization starts with the perturbation initialized from the previous optimization. The results for these ablations evidence that our exact formulation of sequential dilation achieves higher fooling rates in data-free scenario. Further, Figure 3 displays the perturbations obtained through sequential dilation at every layer for VGG-16 network, basically the p l s from Algorithm 1. We also indicate the corresponding fooling rates for each of the perturbation. It is interesting to observe that the fooling rate increases as we successively dilate layers and saturates towards the end, again emphasizing the need for the sequential process.

In many practical attack scenarios, the actual deployed model might not be available to generate the adversarial perturbation. Hence, the ability of the perturbation crafted for one network to cause reasonable fooling on another network is often highly sought-after property. This setting is known as black-box, for which we compare our method with GDUAP (Mopuri et al., 2018) in Table 3 .

The results evidence better black-box performance for our method than the existing data-free work, suggesting higher generalization for the perturbations from sequential dilation. The experiments performed so far show that proposed sequential dilate loss formulation achieves state-of-the-art fooling rates in data-free scenarios. We now consider the case where minimal training data is available, called the less data setting. For this case, the sequential dilation is applied with the limited data. The input to the network at any stage of the optimization is the image added with the current perturbation (x i + p l for layer l). With the help of some data points, we expect the solution to approach more closer to the actual adversarial perturbation obtained with full data. Table 4 indicates the fooling rates of the less data setting with varied amount of training samples. Note that to compare with GDUAP, we also use a validation set to select the best perturbation while training. Our approach performs significantly better than GDUAP when data samples are very less, increasing the practical utility of the method. We also observe that the fooling rates with less data, in general, have increased than data-free and became comparable to full data UAP (see Table 1 ).

Furthermore, Table 5 compares our approach with Singular Fool (Khrulkov & Oseledets, 2018) in extremely less data scenario. For fair comparison with Khrulkov & Oseledets (2018) , we use only 64 images for crafting the perturbation and no validation set is employed. The best perturbation is selected based on the training loss. As expected, our method achieves significantly higher fooling performance than Khrulkov & Oseledets (2018) . Even more, we apply our algorithm with 64 randomly chosen images from Pascal VOC (Everingham et al., 2011) . Interestingly, despite the models used are being trained for a different dataset, the fooling rates remain more or less similar and is higher than that of Khrulkov & Oseledets (2018) . This shows that our approach works well in less data cases even when the available images are not from the dataset on which the model is trained.

5. CONCLUSIONS AND FUTURE WORK:

In this paper, we have presented a new algorithm, called the sequential dilation, to craft universal adversaries in a data-free manner. The approach relies on finding the first singular vector of the linearly approximated neural network. The approximation is being enabled by optimizing with the proposed dilate loss. Elaborate experiments and ablations demonstrate that our approach achieves superior data-free fooling performance. One promising direction for future research would be to modify the algorithm and generate targeted UAP, where the objective is fooling to a specific class.

:



Figures and Tables:

Figure 1: Demonstration of adversarial attack through perturbation generated from our proposed sequential dilation algorithm. The first row shows the clean images with the class predicted by the model, while the second row has the corresponding perturbed samples with the flipped labels.

Figure 3: Intermediate perturbations (p l s) crafted for different layers using our sequential dilation algorithm for VGG-16 network with corresponding fooling rates obtained.

is data dependent (shown for completeness).

Table content: <table><tr><td>Network</td><td colspan="3">UAP Random GDUAP</td><td>Ours</td></tr><tr><td>VGG16</td><td>77.80</td><td>8.20</td><td>44.79</td><td>51.35 ± 1.16</td></tr><tr><td>VGG19</td><td>80.80</td><td>8.14</td><td>40.51</td><td>49.58 ± 0.96</td></tr><tr><td>ResNet 50</td><td>-</td><td>10.01</td><td>32.81</td><td>60.10 ± 0.63</td></tr><tr><td>ResNet 152</td><td>84.00</td><td>8.46</td><td>23.90</td><td>47.37 ± 1.50</td></tr><tr><td colspan="2">Inception v1 78.50</td><td>9.94</td><td>17.59</td><td>52.02 ± 1.05</td></tr><tr><td>Inception v3</td><td>-</td><td>7.83</td><td>21.74</td><td>47.18 ± 1.36</td></tr></table>

Table2reports the results of the various ablative experiments. First Various ablative experiments regarding our approach. It is evident that the proposed sequential dilation algorithm has higher performance than any of its variants.

Table content: <table><tr><td>Network</td><td colspan="4">Single Dilation PSM Maximization Ours without accumulation Ours</td></tr><tr><td>VGG16</td><td>49.46</td><td>24.24</td><td>31.49</td><td>51.35</td></tr><tr><td>VGG19</td><td>44.10</td><td>25.20</td><td>31.00</td><td>49.58</td></tr><tr><td>ResNet 50</td><td>25.62</td><td>16.57</td><td>28.52</td><td>60.10</td></tr><tr><td>ResNet 152</td><td>28.16</td><td>15.85</td><td>13.40</td><td>47.37</td></tr><tr><td>Inception v1</td><td>24.81</td><td>15.57</td><td>39.08</td><td>52.02</td></tr><tr><td>Inception v3</td><td>19.40</td><td>11.92</td><td>26.08</td><td>47.18</td></tr></table>

Black-box testing of data-free sequential dilation approach. Rows indicate the networks used to craft the adversary and the columns specify the one for which the fooling rate is computed. Blue values are the fooling rates obtained by our method, while the red ones correspond to GDUAP.

Table content: <table><tr><td>Network</td><td>VGG16</td><td>VGG19</td><td>ResNet 50 ResNet 152 Inception v1 Inception v3</td></tr></table>

Comparison of fooling rates obtained by our method and GDUAP(Mopuri et al., 2018)  in less data setting with varied number of images available for crafting the perturbation.

Table content: <table><tr><td/><td/><td/><td>GDUAP</td><td/><td/><td/><td>Ours</td><td/></tr><tr><td>Network</td><td colspan="8">D=64 D = 500 D=1000 D=10000 D=64 D = 500 D=1000 D=10000</td></tr><tr><td>VGG16</td><td>71.25</td><td>75.16</td><td>76.20</td><td>75.62</td><td>74.25</td><td>77.66</td><td>78.12</td><td>79.09</td></tr><tr><td>VGG19</td><td>68.65</td><td>73.11</td><td>74.19</td><td>74.73</td><td>66.81</td><td>72.34</td><td>74.00</td><td>74.28</td></tr><tr><td>ResNet 50</td><td>57.94</td><td>71.98</td><td>72.71</td><td>71.64</td><td>70.33</td><td>74.52</td><td>74.54</td><td>76.36</td></tr><tr><td>ResNet 152</td><td>43.95</td><td>67.43</td><td>69.34</td><td>70.48</td><td>68.07</td><td>70.57</td><td>71.52</td><td>71.64</td></tr><tr><td colspan="2">Inception v1 15.83</td><td>85.99</td><td>86.41</td><td>87.10</td><td>60.26</td><td>64.43</td><td>69.68</td><td>71.78</td></tr><tr><td colspan="2">Inception v3 27.13</td><td>53.84</td><td>55.04</td><td>59.88</td><td>81.54</td><td>86.69</td><td>87.21</td><td>87.57</td></tr></table>

Benchmarking our approach in less data scenario with Singular Fool(Khrulkov & Oseledets, 2018) where the adversaries are crafted with just 64 images.

Table content: <table><tr><td/><td>Ours</td><td/><td>Singular Fool</td></tr><tr><td>Network</td><td colspan="3">Imagenet Pascal (Khrulkov &amp; Oseledets, 2018)</td></tr><tr><td>VGG16</td><td>72.13</td><td>76.15</td><td>52</td></tr><tr><td>VGG19</td><td>66.56</td><td>68.87</td><td>60</td></tr><tr><td>ResNet 50</td><td>68.73</td><td>65.69</td><td>44</td></tr><tr><td>ResNet 152</td><td>66.84</td><td>66.47</td><td>-</td></tr><tr><td>Inception v1</td><td>46.74</td><td>40.86</td><td>-</td></tr><tr><td>Inception v3</td><td>76.42</td><td>76.70</td><td>-</td></tr></table>

Peer review (iclr2020):
This paper proposed a white-box (known network architecture, known network weight) data free (without need to access the data) adversarial attacking method. The main idea is to find a perturbation that maximizes the activations at different layers jointly. But the optimization is done sequentially, treating each layer’s activation (before ReLU) as a linear transformation output. The method is compared with existing methods (only one existing approach for the problem, GDUAP by Mopuri et al. 2018) in terms of the fool rate. It shows significant improvement. Ablation study is carried out to compare with baselines like perturbation maximizing only first layer activation, only last layer activation, etc. Also on some other settings (black-box testing, less data) the proposed method outperforms GDUAP. The problem of data-free white-box attack is very interesting and does make sense. The proposed method achieve significant improvement over the previous one (GDUAP). I do have the following concerns though. 1), the novelty of the proposed idea seems relatively limited. The proposed idea seeks perturbation maximizing activations over all layers. It incur perturbation before ReLU. But overall, the flavor of the idea is not significantly different from GDUAP, despite the significant performance boost. 2), it was mentioned that compare with GDUAP, this paper has more theoretical analysis. But this is not very convincing to me. There are many steps of approximation/relaxation from the original problem (Equation (1)) to the final formula (Equation (10)). Many assumptions are made over the steps. It is OK to use these steps to derive a heuristic. But these steps can hardly be called *theoretical analysis*. I am particularly uncomfortable with Equation (5), which is the basis of the main idea. It assumes that all data in are in the same orthant as . But this is unrealistic as different data in X will for sure incur different activation patterns. Did I misunderstand anything? 3) I do like the experimental results. It looks impressive. But the baselines are really limited (granted, there are not many existing approaches). There is only one task (image classification). How about other tasks like segmentation etc shown in Mopuri et al. 2018? Also it would be nice to also show the results of other UAP methods, as it gives us a better sense of the gap between with and without data. 4) I wonder how will the attack affect some model which has been trained with some defense mechanism, e.g., adversarial training. Typo: Equation (5), RHS missing a max