Robust Universal Adversarial Perturbations
Authors: Changming Xu
Gagandeep Singh
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial Machine Learning
Trustworthy Machine Learning
Universal Adversarial Perturbation
Expectation over Transformation
Robustness
Adversarial Perturbation

Abstract: Universal Adversarial Perturbations (UAPs) are imperceptible, image-agnostic vectors that cause deep neural networks (DNNs) to misclassify inputs from a data distribution with high probability. In practical attack scenarios, adversarial perturbations may undergo transformations such as changes in pixel intensity, rotation, etc. while being added to DNN inputs. Existing methods do not create UAPs robust to these real-world transformations, thereby limiting their applicability in attack scenarios. In this work, we introduce and formulate robust UAPs. We build an iterative algorithm using probabilistic robustness bounds and transformations generated by composing arbitrary sub-differentiable transformation functions to construct such robust UAPs. We perform an extensive evaluation on the popular CIFAR-10 and ILSVRC 2012 datasets measuring our UAPs' robustness under a wide range common, real-world transformations such as rotation, contrast changes, etc. Our results show that our method can generate UAPs up to 23% more robust than existing state-of-the-art baselines. 

Under review as a conference paper at ICLR 2023
ROBUST UNIVERSAL ADVERSARIAL PERTURBATIONS
Anonymous authors Paper under double-blind review
ABSTRACT
Universal Adversarial Perturbations (UAPs) are imperceptible, image-agnostic vectors that cause deep neural networks (DNNs) to misclassify inputs from a data distribution with high probability. In practical attack scenarios, adversarial perturbations may undergo transformations such as changes in pixel intensity, rotation, etc. while being added to DNN inputs. Existing methods do not create UAPs robust to these real-world transformations, thereby limiting their applicability in attack scenarios. In this work, we introduce and formulate robust UAPs. We build an iterative algorithm using probabilistic robustness bounds and transformations generated by composing arbitrary sub-diffcrentiable transformation functions construct such robust UAPs. We perform an extensive evaluation on the popular CIFAR- 10 and ILSVRC 2012 datasets measuring our UAPs' robustness under a wide range common, real-world transformations such as rotation, contrast changes, etc. Our results show that our method can generate UAPs up to 23% more robust than existing of-th-of-thearr baselines.
INTRODUCTION
Deep neural networks (DNNs) have achieved impressive results in many application domains such as natural language processing (Abdel-Hamid et al. 2014 Brown et al. 2020), medicine (Esteva et al., 2017: 2019), and computer vision (Simonyan & Zisserman 2014 Szegedy al. 2016). Despite their performance, they can be fragile in the face of adversarial perturbations: small imperceptible changes added to a correctly classified input that make a DNN misclassify. While there large amount of work on generating adversarial perturbations (Szegedy et al.
2013 Goodfellow et al.
2014 Moosavi- Dezoool al., 2016 Madry al., 2017 Carlini & Wagner 2017 Xiao al. 2018a
et al. [209 Andriushchenko et al. 2019 Tramer et al.) (020), the threat model considered by these works cannot be realized in practical scenarios. This is because the threat model depends upon unrealistic assumptions about the power of the attacker: the attacker knows the DNN input in advance, generates input spput-specific perturbations in real-time and exactly combines the perturbation with the input before being processed by the DNN.
Dong et 2018 Croce& & Hein 2019 Wang et al.
Practically feasible adversarial perturbations. In this work, we consider a more practical adversary reveal real- wal-world vulnerabilities of state-of-fe state-of-the-arr the-art DNNs. We assume that the attacker (i) does not know the DNN inputs in advance, (ii) can only transmit additive adversarial perturbations, and (iii) their transmitted perturbations are susceptible modification due to real-work effects. Examples of attacks in our threat model include adding stickers to the cameras for fooling image classifiers (Li al. 2019bb or transmitting perturbations over the air for deceiving audio classifiers (Li al. 2019a). Note that this threat model is distinct from directly generating adversarial examples (Athalye et al. 2018 which require access the original input.
The first two requirements in our threat model can be fulfilled by generating Universal Adversarial Perturbations (UAPs) Aitoosvvi-ezzfore et al. 2017). Here the attacker can train a single adversarial perturbation that has high probability of being adversarial on all inputs in the training distribution. However, as our experimental results show, the generated UAPs need to be combined with the DNN inputs precisely, otherwise they fail to remain adversarial. In practice, changes to UAPs are likely due to real-world effects. For example, the stickers applied to a camera can undergo changes in contrast due to weather conditions or the transmitted perturbation in audio transmission channel. This non non-robustness reduces the efficiency of practical attacks created with existing methods (Moosavi-Dezfooll et al. 2017 Shafahi al. 2020 Li et al. 2019bla).
change due to noise in the

---

Under review as a conference paper at ICLR 2023
Transformed
Transformed
Robust UAP
Standard UAP
Misclassification
Correct Classification
Figure 1: Robust UAPs (left) cause classier to misclassify on most of the data distribution even after transformations are applied on them. Standard UAPs (right) are not robust to transformations and have low probability of remaining UAPs after transformation.
This work: Robust UAPs. To overcome the above limitation, we propose the concept of robust UAPs: perturbations that have high probability of remaining adversarial on inputs in the training distribution even after applying set of real-world transformations. The optimization problem in looking
generating robust UAPs (Moosavi-Dezfooli et al., 2017) is the main challenge for perturbations that are adversarial for a set of inputs as well as to transformations applied to the perturbations. To address this challenge, make the following main contributions:
We introduce Robust UAPs and formulate their generation as an optimization problem.
We design a new method for constructing robust UAPs. Our method is general and works for any transformations generated by composing arbitrary sub-differentiable transformation functions. We provide an algorithm for computing provable probabilistic bounds on the robustness our UAPs against many practical transformations.
We perform extensive evaluation of the effectiveness of method, RobustUAP, on state- of-the-art models for the popular CIFAR- 10 (Krizhevsky et al. 2009) and ILSVRC 2012 (Deng ct al.] (209) datasets. We compare the robustness of our UAPs under compositions of challenging real-world transformations, such as rotation, contrast change, etc. We show that on both datasets, the UAPs generated by RobustUAP are significantly more robust, achieving up 23% more robustness, than the UAPs generated from the baselines.
Our work is complementary to the development of real-world attacks (Li al. 2019a b in vari- ous domains, which require modeling how the universal perturbations change during transmission. RebustUAF can improve the efficiency of such attacks by constructing perturbations that are more robust against domain-specific, real-world transformations than possible with existing algo-
rithms -Moosavi-Dezooolii et al. 2017 Shafahi al. 2020 Li
2019a
BACKGROUND
In this section, we provide necessary background definitions and notation for our work.
Adversarial Examples and Perturbations. An adversarial example a misclassified data point that is close (in some norm) to correctly classified data point (Goodfellow et al.) [0144] Madry et al. 2017 Carlini & Wagner 2017). Let μ. C. IR be the input data distribution, x μ be an input point with the corresponding true label y E R. and Rd Re be our target classifier. For ease of notation, we define (x) to be the 4 element fxx and allow f(x) = arg max; fi( to directly refer to the classification label. We use to reference image specific perturbations and to reference universal adversarial perturbations, Vr and u, refer to the robust variants and will be defined Sec.
3 We now formally define adversarial example.
Definition 2.1. Given correctly classified point distance function d(-.-) 12 x RRd RR and bound e RR, x' is an adversarial example iff d(x', x) and f(x') # y.
In this paper, we consider examples x' generated x' X+V where v is an adversarial perturbation.
2

---

Under review as a conference paper at ICLR 2023
Universal Adversarial Perturbations. UAPs are single vector, input-agnostic perturba- tions (Moosavi- Dezfool et 2017). They differ from traditional adversarial attacks, which create perturbations dependent each imput sample. To measure UAP performance, introduce the notion of universal adversarial success rate, which measures the probability that a perturbation u when added to x, sampled from μ., causes change in classification under
Definition 2.2. Given a data distribution js, and perturbation universal adversarial success rate ASRy for u, is defined as
ASRU(M
(f(x u) + f(x)) x~pp
Using Definition 2.2.
formally define UAP.
Definition 2.3. A universal adversarial perturbation is vector E I which, when added to almost all datapoints in y causes the classifier / misclassify. Formally, given 7, bound on universal ASR, and 1p- norm with corresponding bound is UAP iff ASR (J. u) > 7 and ||l||p <
In general, the additive perturbations have small 1p-norm then they look like noise and do not affect the semantic content of the image. For of notation in later parts of the paper, also pose the construction of UAPs as an expectation minimization problem:
arg min (0(fl u), [x))] s.t. ||u|| <e
where 5 is the Kronecker Delta function AAgaraal 2013).
ROBUST UNIVERSAL ADVERSARIAL PERTURBATIONS
In this section, we will define the optimization problem for generating robust UAPs. We first define transformation sets and neighborhoods.
Definition 3.1. A transformation, т, composition of bijective sub-differentiable transforma- tion functions. A transformation set, T, is a set of distinct transformations. A point v' is in the neighborhood Nr(v), of v, there a transform in T that maps to v'. Formally,
N'EN(v = Er T s.t. T(V) v
Example 3.2. Let T' be the set of all transformations represented by rotation of +30 scaling of up to factor of 2, and a translation of up to +2 pixels. in this case one E could be (rotation of 8" scaling factor of 1.2, and translation of -1.3) in that order and (v((v) would include any point that can be obtained by applying one of the transformations from T on v.
In order to define robust UAPs we introduce robust universal adversarial success rate. Definition 3.3. Given data distribution μ., transformation set T, universal ASR level 7, bound n,-oomm and perturbation u, robust universal adversarial success rate, ASR is defined as,
(ASRE u',) 7 ASR T, u,) (L,,)((u.))
uu <))
The robust universal adversarial success rate measures the probability that neighbor of u, is also an UAP on Jr, i.e. after transformation it maintains high universal ASR. We note that even though ||ue|lp c, can happen that u', E Nr (u,) has |ulllp > this is particularly true for the semantic transformations considered in this work. Therefore, we require that the norm of u' is small.
Using Definition 3.3 we can now formally define a robust UAP.
Definition 3.4. A robust universal adversarial perturbation, ur, is which most points within neighborhood of u, when added to most points in fool the classifier, f. u, satisfies || < and ASR p, T, T,7. u,) >
In order to construct robust UAPs, we can pose the following expectation minimization problem: [5(f(x u4), [xx)) s.t. ||l||p < (5)
arg min
[T[[[(4]1 <) x E x-
(
3

---

Under review as a conference paper at ICLR 2023
Here I F R denotes indicator function. The inner expectation represents the UAP condition for the transformed perturbation u, while the outer expectation represents the neighborhood robustness condition. Solving Equation over the transformation set and data distribution. This composition makes it computationally harder than minimizing over only the transformation set, in EOT (Athalye et al. (0118). than minimizing over only the data distribution, as done for standard UAP (Moosavi- -eeavii et al. (017).
[ requires computing u, which minimizes the expectation
4 GENERATING ROBUST UNIVERSAL ADVERSARIAL. PERTURBATIONS
In this section, we will discuss our approach for optimizing Equation 5 to generate UAPs robust to transformations generated by composition of arbitrary sub-differentiable transformation functions. At high level, the objective the transformations applied on the perturbation, with the inner expectation, a UAP objective over the input data distribution. We first describe intuitive baselines for optimizing Equation and then present our new algorithm, RobustUAP.
be seen gluing the outer expectation, EOT objective over
4.1 STOCHASTIC GRADIENT DESCENT
The first baseline directly solves Equation 3 Jsing gradient descent. Since we are solving a constrained optimization problem, cannot gradient descent directly. Instead,
solve the Lagrangian- relaxed form of the problem as in (Carlini & Wagner 2017 Athalye et al. 2018).
arg min Ur (,EN)(,,)
[T([)u(,1 <)) E [6(f(x + u()), [(x)]] Al|ur|lz x--ji
We use a momentum based Stochastic Gradient Descent (SGD) method for solving Equation 6 Shafahi et al. (2020) suggests that this is effective method for generating standard UAPs. In order to implement this, we replace the Kronecker Delta function with a loss function, L. We iteratively converge towards the inner expectation by computing it in batches, and towards the outer expectation by sampling large number of transformations. Given that we would like to estimate on a batch, μl, and random set of transformations sampled from T, f T, we can approximate Equation 6
[
7 )1 X
<
Σ
L[f($: + (u.)) f(s)] A||ur||p
|
Our final algorithm is in Appendix
4.2 STANDARD UAP ALGORITHM WITH ROBUST ADVERSARTAL. PERTURBATIONS
For our second baseline, we leverage the standard UAP algorithm from Moosavios
et al, (2117)
(see Appendix D for the algorithm). The standard UAP algorithm iterates over the entire training dataset and at each input, X;, computes the smallest additive change, Au, to the current perturbation, u. that would make Au adversarial perturbation for X;. Intuitively, over time the algorithm will approach perturbation that works on most inputs in the training dataset. This approach works by computing robust adversarial perturbations rather than standard adversarial perturbations. At each point we compute the smallest additive change, Au, to the current robust ad adversarial perturbation, ur that would make u, + Au, robust adversarial perturbation for Xj.
We search for robust adversarial perturbations by optimizing the expectation that a point in the neighborhood of v, adversarial while restricting the perturbation to an Ip norm of c. We formulate this as the following minimization problem:
arg min E Ve VENT(v.)
[[[||Í||| < e) x x(f(x + v.). s.t. ||vrllp <e
(8)
4.3 ROBUST UAP ALGORITHM
The baseline algorithms have two fundamental limitations: (i) they rely random sampling the symbolic transformation region, but the sampling strategy does not explicitly try to maximize the robustness of the generated UAP over the entire symbolic region, and (ii) they do not estimate
4

---

Under review as a conference paper at ICLR 2023
robustness unsampled transformations. As result, the baselines yield suboptimal UAPs (as confirmed by our experiments below). To overcome these fundamental limitations, we create a method entire symbolic region. We leverage
to compute probabilistic bounds for expected robustness this method for approximating expected robustness in a new algorithm to generate robust UAPs with guarantees. We make simplifying assumption that (rr))) has a well defined, sampleable probability density function (PDF) as we cannot bound robustness for arbitrary transformations. Our experiments show that even though our assumptions do not hold for all the transformation sets considered in this work, they significantly improve the robustness of our generated UAPs. Our approximation of the expected robustness relies on the following theoretical result:
Theorem 4.1. Given perturbation Up neural network f, finite set of inputs X, set of transformations T, and minimum universal adversarial success rale E R. Let p(7) Pu, Puç-Nr (w.) (AS (y X, u',) 7). For II..n, let ut Nr(ue) be random variables with a well defined PDF and 1 IR + IR be the indicator function, let
pm((7) 1 Σ
((AS u²)
(9)
For accuracy level, v/ E (0, 1), and confidence, @ E (0, 1), where (0, 1) is the open interval between 0 and 1. Ifn 2 20 In 2 then 3
((()(()) - p(7) < vb) 2 -
(10)
Proof. The bound on n is derived via the Chernoff inequality applied to (7) and (1)r =
p(7) Chernoff 1952 Alippi 2014). Equation holds since computing universal ASR is Lebesgue
measurable over the data distribution and since we assume (u,) has well defined PDF. t
Theorem states that with enough samples from the neighborhood of a perturbation, ur, the adversarial success rate of u, the entire neighborhood is arbitrarily close to the adversarial success rate of u, on sampled transformations with probability greater than 1- Φ. One key observation is that the Chernoff bound is independent of the dimensionality of the sample space which allows to efficiently apply this result to high-dimensional transformation set provided they have a well-defined PDF (e.g., -ball and obtain provable bounds on the expected robustness. For the combinations of semantic transformations, such as rotation, translation. etc. used in the experiment section the neighborhood does not have well-defined PDF, thus we uniformly sample the parameter space of each transformation to produce point in the neighborhood. We believe uniformly sampling the parameter space is a realistic approximation of real-world effects.
we create BatimateRobustnes confidence, d returns the robust adversarial success rate on a finite set of inputs with prob- abilistic robustness guarantees under the assumptions of Theorem 4.1 The pseudocode for EstimmteRobustnne is in Algorithm]]
Leveraging Theorem
which given accuracy, v and
Algorithm 1 Estimateeobustness
1: Draw n = - In 21 samples T2 ~ T
20 2: Compute (7) vs E. (F, (. > >))
3: Return (7)
Our algorithm: RobustUAP, We leverage Theorem 4. and Algorithm to develop RobustUAP, the pseudocode for which is seen in Algorithm 2 Similar the SGD baseline, we approximate the expectation in Equation 5 in batches. We start by sampling transformations from the PDF of the neighborhood. We set the number of transformations, n, based on Theorem 4.1 to satisfy the desired confidence level and accuracy. For each gradient step, we compute the mean loss over the current batch and set of sampled transforms (line 8). For each set of batch and sampled transformations, instead of making single gradient update like SGD, we use Projected Gradient Descent (PGD) to iteratively compute a more robust update to the universal perturbation and end only when the estimated robustness on the batch satisfies a given threshold (line 10). At the end of each epoch, we check the robustness across the entire training set and transformation space using Es t immt e eRobust.ness and stop when we have reached the desired performance (line 14).
5

---

Under review as a conference paper at ICLR 2023
Algorithm 2 Robust UAP Algorithm
Initialize up + 0, - 2 In $1
2: For iori=1 1.....1 sample T3 ~
3: repeat
4: for B C X do
5: if Est P.stimateRobbussesss.... B, y, 0) < then
6: Au, +
7: repeat
8:
Compute LB,- x
B
Σ3 L[ ///[Bii+00 + (ur (rr + Au,)), (BB))
9:
Aur, = (A, + osign( VLB.)))
until Est paatteRbbssteess((
7,7, u, + Aur, 1/ Φ) <
11: Update the perturbation with projection: ur Pp.c (ur + Aup)
12: end if
13: end for
14:
until EstinatteRobustnessj... J. v.))) <S
EVALUATION
Our RobustUAP framework is applicable to all transformation sets in a variety of do- mains. We empirically evaluate our method RobustUAP and three baseline approaches (SGD, StandardUAP RP, StandardUAP (Moosavi-Dezfooll et al. (017)) on popular models from the vision domain. We show that RobustUAP is more robust on both uniform random noise and compositions of real-world transformations such as rotation, scaling, etc.
Experimental evaluation. We consider two popular image recognition datasets: CIFAR- 10(Krizhevsky et al., 2009) and ILSVRC 2012(Deng et al., (009). For CIFAR- 10, we evaluate on the entire test set (1,000 images) and use a state-of-the-ar pretrained VGG16 (Simonyan & Zisserman 2014) network as the target classification model. For ILSVRC 2012, we evaluate random subset of the test set (1,000 images), and use a state-of-the-ar Inception-v3 (Szegedy et al. 2016) network. We evaluate the robustness against uniform random noise as well as composition of transformations from brightness/contrast, rotation, scaling, shearing, and translation. All experi- ments were performed desktop PC with GeForce RTX(TM) 3090 GPU and 16-core Intel(R) Core(TM) 19-9900KS CPU @ 4.00GHz.
We report the results for Ionmm with 100 for ILSVRC 2012 and 10 for CIFAR-10 10. These values were chosen based on the values presented by the original UAP paper (Moosavi- -ezzooll al., (017). We scaled our values accordingly. We note that the e-values are significantly smaller than the image norms. Therefore the generated perturbation is imperceptible and does not affect the semantic content of the image. Due to the hardness of the optimization problem, for the same norm value, the effectiveness of UAP is less than input-specific perturbations. We note that crafting input-specific perturbations requires making unrealistic assumptions about the power of the attacker mentioned the introduction and therefore we do not consider them part of our threat model which aims to generate practically feasible perturbations. We use v 0.05 and Ø 0.05 resulting in = 738 for generating samples for our RobustUAP algorithm as well as reporting robust ASR in our evaluation. The UAPs trained on 2,000 images, other parameters for evaluation given in Appendix
image normalization function given by our pretrained models and thus
5.1 ROBUSTNESS TO RANDOM NOISE
First, we show that our algorithm generates UAPs robust against uniform random noise. Here our neighborhood is defined as an Los ball of radius around the perturbation. U(c) represents noise drawn uniformly from such a ball. Figure 2 shows the performance of each algorithm. For example, the RobustUAP algorithm achieves a ASRG of 0.9 greater than 97% of the time under (0.1)) on CIFAR- 10, where all other algorithms achieve 0.9 at most 30% of the time. Robust UAP outperforms all other algorithms for both noise sizes. St Sndd has lower variance in universal ASR and is much less robust to transformation. table of Robust ASR results for 7 0.8 can be seen in Appendix Our Robust ASR results guaranteed to be +0.05 from the
and higher

---

Under review as a conference paper at ICLR 2023
actual result with probability of 95%. For example, estimate that Robust has ASR of
96.1% for U(,.3), we are guaranteed that the true robustness 91.1% with a probability of 95%.
Note that we get robustness guarantees from Est Bstimateeobustnes well-defined PDF
neighborhood has
(a) U.O. -)- ILSVRC
(b) U(03))- ILSVRC
(c) U(0.1) (C0.1)))CIIAR- CIFAR-IO
(d) L(0.3) CIFARRI0
6 of &'Sapples
25
.50
BrandardUAF
RobustUAP
0.775
0,800
0.825
0.850
0.3
0.6
0.7
0.8 Universal ASR
0.9
0.7
0.8
0.9
0.6
0.8
Figure 2: For each method, point (æ, y) in the corresponding line represents the percentage of sampled UAPs (y%) with Universal ASR æ for U (0.1) and (0.3) on ILSVRC and CIFAR-10.
5.2 ROBUSTNESS TO SEMANTIC TRANSFORMATIONS
Next, we consider transformation sets generated by composing five popular semantic transformations in existing literature (Athalye et al. 2018 Balunović al. 2019): brightness/contrast, rotation, scaling, shearing, and translation.
We use variety of different compositions to show that our algorithm works under different conditions, and base our parameters for the transformations on (Balunović et al., 2019). For our experiments, R(6) corresponds rotations with angles between = [ y). to translations of + horizontally and ty vertically; Sc(p) to scaling the image between =p%; Sh(m) to shearing by shearing factor between =m%; and B (a, (3 changes in contrast between =a% and brightness between +. Further details about these transformations can be seen in Appendix A We consider compositions of different subsets and ranges these transformations shown in Table Tableeiinlinn including composing all transformations together. The hardness of generating robust UAPs depends transformation set has on the UAP (i.c. random noise has a relatively small effect compared to rotation). The hardness also increases with the number of transformations in the composition well as the range of parameters for each individual transformation. For example, generating robust UAPs harder for the composition shown in the first and last row for ILSVRC 2012 in Table @ableeccmppr compared to the second and third row. The same is true for generating a UAP robust to uniform random noise.
the effect that the
(d) R(10, (100)))2.))8()))S(()
R(20)
(b) T(2.2)
(c) Sc(5) ((000)
Br2, 0.001)
100
% of Samples
50
Stander 290
25
Stand BP
SebustUAP
02
0.2
Universal ASR
Figure 3: For each method, a point (x. y) in the corresponding line represents the percentage of sampled UAPs (y%) with Universal ASR for the different semantic transformations on ILSVRC.
Robust ASR (ASRR). Figure shows performance of UAPs obtained by applying 738 randomly sampled transformations to the original UAPs generated by different methods on ILSVRC, similar graphs for CIFAR-IO can be found in Appendix G The Robust algorithm outperforms all others in each case, observe that for these harder transformation sets St StandardUA. loses its effectiveness completely. In Table we compare robust universal adversarial success rate ASR with y 0.6, in other words, are still UAPs with 60% effectiveness on the testing set. We provide average ASR,, scores as well as ASR z for different y levels in Appendix
finding the percentage of sampled neighbors of the perturbation that
7

---

Under review as a conference paper at ICLR 2023
Our RobustUAP algorithm achieves at least 53.4% higher robust ASR when compared to the standard UAP algorithm on both datasets and the challenging transformation sets shown Table []] Furthermore, our Robust tusuuutA.. UAP algorithm significantly outperforms both robust baseline approaches. Except for the 7(2, 2) case which we observe to be the easiest, AebustJAP achieves at least 1 11.6% performance gain over the baselines. SGD is the best performing baseline and achieves high robust ASR on relatively easier transformation sets performing within 1% of Robust UAP on T(2, 2). On
harder transformation sets, this gap widens considerably, see Table !
STANDARD
SGD
STANDARD UAP RP
RceUsT UAP
DATASET
TRANSFORMATION SET
UAP
R(20)
0.0%
69.9%
2.9%
93. 93.2%
ILSVRC
T(2,2)
35.9%
96.1%
38.8%
97.1%
2012
Sc(5), R(5), B(5, 0.01) R(10), T(2, (2))) 0(2,0.00))
22.3%
85.4%
43.7%
96.1%
0.0%
63.1%
2.9%
86.4%
R(30), (.200.001)
0.0%
64.1%
2.9%
75.7%
CIFAR-10
R(2).Sh(22 Sh((2 R(10),
42.7%
88.3%
52.4%
96.
Sc(2), 8(2,0.001)
0.0%
58.3%
7.8%
79.6%
Table I: Robust ASR of RobustUAP compared to the three baselines.
Visualization. We visualize UAPs generated with RobustUAl and Standa rdUAP transformed with random transformations from R( (((10), T22 2), Sh(2), Sc(2), (2, 0.001) and added to images in ILSVRC 2012 Figure Our robust UAPs have similar level imperceptibility to standard UAPs and do not affect the semantic content of the images. Robust UAPs affect the model classification after transformation with high probability, unlike standard UAPs
pontengerr
gelle
show shop
mensuning cup
partrid
Ungernibbd
paper
werding
paper
f
shop
measuring cup
partridge
Figure 4: Examples of perturbed images with labels. The top row is unperturbed ILSVRC 2012 test set images, the second row has randomly transformed robust UAP added to it, and the bottom row has randomly transformed standard UAP added to it. Labels calculated using Inception-v3.
We further visualize UAPs generated with our three robust algorithms on the same transformation set against a standard UAP generated ILSVRC 2012 Figure [ We observe that UAPs generated by the Standa rdJAP algorithm resemble those generated by the StandardUAF RP algorithm. We believe that this due to the similarity in the workings of both algorithms. However, the two UAPs are not identical. Under our transformation set the center of the image is least likely to be perturbed so we observe St Standa rdUAP_R algorithm concentrates its budget towards the center. Both the RobustUAP and the SGD algorithm generate larger patterns distributed over the entire image.
5.3 ADDITIONAL EXPERIMENTS
In Appendix we show how our robust UAPs compare to standard UAPs on the non-robust uni- versal ASR metric. In Appendix D we evaluate our methods on ResNet18 (He et al.) 2015) and MobileNet (Howard et al. 2017) for CIFAR-10 and ILSVRC 2012 respectively. The results follow H we provide the average ASRg achieved
the same trends those reported in Table I In Appendix by all the algorithms and also provide ASR computed with different values of for the same transformation sets in Table Finally, provide runtimes for all algorithms in Appendix
8

---

Under review as a conference paper at ICLR 2023
(a) UAP
(b) SGD
(c) StandardUAP RP
(d) RobustUAP
Figure 5: Comparison of UAPs generated with (a) StandardUAP, (b) RobustUAP, (c)
StandardUAP _R,,_R,, and (d) RobustUAP on 2012.
6 RELATED WORK
In this section, we survey works closely related ours.
UAP Algorithms. Most works focusing on UAPs (Moosavi-Dezoooli et al. 2017 Mopuri et et. 2018
Zhang et al. 2020aa Khrulkov & Oseledets] 2018 Li al. 2020] Akhtar al. (018)] Hendrik Met zen et al. 2017] Zhang et al., (020b) generate singular vectors and do not consider perturbation robustness, Bahramali et al. (2021) introduces a perturbation generator model (PGM) for the wireless domain which creates UAPs with random trigger patterns. They show that both adversarial training and noise subtracting defenses used in the wireless domain are highly effective in mitigating the effects of a single vector UAP attack; they further show that their method of generating a set of UAPs an effective way for attacker to circumvent these defenses. Although PGM provides method for efficiently sampling unique UAPs, they do not train to be robust to real-world transformations. In contrast, our method enables efficient sampling of UAPs that are robust transformations.
Robust Adversarial Examples. The following papers introduce notions of robustness under different viewpoints and environmental conditions for constructing realizable adversarial examples. This is different threat model compared to the additive perturbations discussed in this paper. Luo et al. (2018) constructs adversarial examples which minimize human detectability, further introducing the idea of robustness for adversarial examples. They show that their attacks are robust against jpeg compression. [Sharif et al. (2016) attack facial recognition systems by putting adversarial perturbations on glass frames. Their work demonstrates successful physical attack under stable conditions and poses. Eykholt et al. (2018) proposes Robust Physical Perturbations (RP2) in order to show that adding graffiti Athalye et al.] (2018) introduce Expectation over Transformation (EOT) and use to print real- world objects which are adversarial given range of physical and environmental conditions.
stop sign cause it to be misclassified in both simulations and in the real world.
Robust Adversarial Perturbations. Li et al. 2019a) generates music which affects a voice assistant based system from picking up its wake word. Li et al. (2019b) presents method for generating targeted adversarial sticker which changes an image classifier's classification from one pre-specified class another. Both of these methods rely on specific use cases and are tailored towards generating adversaries coming from strict distributions, e.g. (Li et al. (2019) generates guitar music while (Li et al.) 2019b) generates a small grid of dots. These works build on algorithms akin our baseline approaches and are limited in scope to domain specific transformations. Our work provides a framework for improving robustness against a wide range of transformations in diverse domains and can be leveraged for improving the effectiveness of these attacks.
CONCLUSION
In this paper, we demonstrate that standard UAPs are highly susceptible to transformations, i.e. they fail to be universally adversarial under transformation. We propose new method, RobustUAP to generate robust UAPs based upon obtaining probabilistic bounds on UAP robustness across an entire transformation space. Our experiments provide empirical evidence that this principled approach generates UAPs that are practically more robust under a wide range of transformation sets than those from the baseline methods.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Ossama Abdel-Hamid, Abdel-rahman Mohamed, Hui Jiang, Li Deng, Gerald Penn, and Dong Yu. Convolutional neural networks for speech recognition. IEEE/ACM Transactions on audio, speech, and language processing, (510)))533-1555 2014.
DC Agarwal. Tensor Calculus and Riemannian Geometry. Krishna Prakashan Media, 2013.
Naveed Akhtar, Jian Liu, and Ajmal Mian. Defense against universal adversarial perturbations. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 3389-3398, 2018.
Cesare Alippi. Intelligence for embedded systems. Springer, 2014.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search, 2019.
Anish Athalye, Logan Engstrom, Andrew Ilyas and Kevin Kwok. Synthesizing robust adversarial examples. In International conference machine learning, pp. 283-293. PMLR, 2018
Alireza Bahramali, Milad Nasr, Amir Houmansadr, Dennis Goeckel, and Don Towsley. Robust adver- sarial attacks against din-bbsed wireless communication systems. arXiv preprint arXiv:2102.0099
2021.
Mislav Balunović, Maximilian Baader, Gagandeep Singh, Timon Gehr, and Martin Vechev. Certifying geometric robustness of neural networks. Advances Neural Information Processing Systems 32,
2019.
Philipp Benz, Chaoning Zhang, Tooba Imtiaz, and In So Kweon. Double targeted universal adversarial perturbations. In Proceedings of the Asian Conference on Computer Vision, 2020.
Philipp Benz, Soomin Ham, Chaoning Zhang, Adil Karjauv, and In So Kweon. Adversarial robustness comparison of vision transformer and mip-mixer to cnns. arXiv preprint urXiv:21 2021.
Tom В Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. arXiv preprint arXiv:2005.14165. 2020.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium security and privacy (sp), pp. 39-57. IEEE, 2017.
Herman Chernoff. A measure of asymptotic efficiency for tests of hypothesis based on the sum of observations. The Annals of Mathematical Statisticy, pp. 493-507, 1952.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hier- archical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248 255, 2009. doi: 10. 109100RR..0009.000 200666
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition scale. arXiv preprint arXiv:2010.1 000/0///999,, /999, 2020.
Andre Esteva, Brett Kuprel, Roberto A Novoa, Justin Ko, Susan M Swetter, Helen M Blau, and Sebastian Thrun. Dermatologist-level classification of skin cancer with deep neural networks. nature, 142(7639): 2017.
10

---

Under review as a conference paper at ICLR 2023
Andre Esteva, Alexandre Robicquet, Bharath Ramsundar, Volodymyr Kuleshov, Mark DePristo, Katherine Chou, Claire Cui, Greg Corrado, Sebastian Thrun, and Jeff Dean. A guide to deep learning in healthcare. Nature medicine, 25(1):24-29, 2019.
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1625-1634, 2018.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv::442.663: 2014.
Kaiming He, X Zhang, S Ren, and Sun. Deep residual learning for image recognition." computer vision and pattern recognition (2015). Google Scholar There is no corresponding record for this reference, pp. 770-778, 2015.
Jan Hendrik Metzen, Mummadi Chaithanya Kumar, Thomas Brox, and Volker Fischer. Universal adversarial perturbations against semantic image segmentation. In Proceedings of the IEEE international conference on computer vision, pp. 2755-2764, 2017.
Andrew G Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang. Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint /70.:04000444//111 2017.
Max Jaderberg, Karen Simonyan, Andrew Zisserman, et al. Spatial transformer networks. Advances in neural information processing systems, 28:2017-2023 2015.
Oguzhan Fatih Kar, Teresa Yeo, Andrei Atanov, and Amir Zamir. 3d common corruptions and data augmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 18963-189744 2022.
Valentin Khrulkov and Ivan Oseledets. Art of singular vectors and universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 8562- 8570, 2018
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images, 2009.
Juncheng Li, Shuhui Qu, Xinjian Li, Joseph Szurley, J. Zico Kolter, and Florian Metze. Adver- sarial music: Real world audio adversary against wake-word detection system. In Proc. Neural Information Processing Systems (NeurIPS), pp. 11908-11918, 2019a.
Juncheng Li, Frank R. Schmidt, and J. Zico Kolter. Adversarial camera stickers: A physical camera- based attack on deep learning systems. In Proc. International Conference Machine Learning, ICML, volume 97, pp. 3896-3904, 2019b.
Yingwei Li, Song Bai, Cihang Xie, Zhenyu Liao, Xiaohui Shen, and Alan Yuille. Regional homo- geneity: Towards learning transferable universal adversarial perturbations against defenses. In European Conference on Computer Vision, pp. 795-813. Springer, 2020.
Bo Luo, Yannan Liu, Lingxiao Wei, and Qiang Xu. Towards imperceptible and robust adversarial example attacks against neural networks. In seirty- aaai conference on artificial intelligence, 2018.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 7706006083, 2017.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2574-2582, 2016.
Seyed-Mohsen Dezfovi- Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1765-1773, 2017.
11

---

Under review as a conference paper at ICLR 2023
Konda Reddy Mopuri, Aditya Ganeshan, and R Venkatesh Babu. Generalizable data-free objective for crafting universal adversarial perturbations. IEEE transactions on pattern analysis and machine intelligence, 41(10):2452 2465, 2018.
Ali Shafahi, Mahyar Najibi, Zheng Xu, John Dickerson, Larry S Davis, and Tom Goldstein. Universal adversarial training. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 5636-5643 2020.
Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. Accessorize a crime: Real and stealthy attacks on state-of-the-ar face recognition. In Proceedings of the 2016 acm sigsac conference on computer and communications security, pp. 1528-1540, 2016.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 1556, 2014.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818 18-8222.. 2016.
Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. CoRR, abs/2002.08347. 2020.
Shiqi Wang, Yizheng Chen, Ahmed Abdou, and Suman Jana. Enhancing gradient-based attacks with symbolic intervals, 2019.
Chaowei Xiao, Bo Li, Jun yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. In Proc. International Joint Conference Artificial Intelligence (1JCAI-88), pp. 3905-3911, 2018a.
Chaowei Xiao, Jun- Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. arXiv preprint arXiv: /00100/000020/11 2018b.
Chaoning Zhang. Philipp Benz, Tooba Imtiaz, and So Kweon. Understanding adversarial examples from the mutual influence of images and perturbations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14521-14530 2020a.
Chaoning Zhang, Philipp Benz, Tooba Imtiaz, and In-So Kweon. Cd-uap: Class discriminative universal adversarial perturbation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 6754-6761, 2020b.
Tianhang Zheng, Changyou Chen, and Kui Ren. Distributionally adversarial attack. Proc. AAAI Conference Artificial Intelligence, 53:2253-2266 07 2019.
12

---

Under review as a conference paper at ICLR 2023
APPENDIX
A SEMANTIC TRANSFORMATIONS
In this section, discuss the semantic transformations used in the paper. Brightness and contrast be represented via bias (3) and gain (a > 0) parameters respectively. Formally, if x is the original image, then the transformed image, x', be represented
x ox + B
(11)
Rotation, scaling, shearing, and translation are all affine transformations acting on the coordinate system, c, of the images instead of the pixel values, x. In order recover the pixel values and differentiate over the transformation. we will need sub-differentiable interpolation. see Appendix B For finite dimensions, affine transformations can be represented as linear coordinate map where the original coordinates are multiplied by an invertible augmented matrix and then translated with additional bias vector. Below, we give the general form for an affine transformation given augmented matrix A, bias matrix b, and input coordinates We can compute the output coordinates, c, as
c'
[ccole]
(12)
1
1
Below, give the augmented matrix A and additional bias matrix b for rotation, scaling, shearing, and translation.
Rotation, R(0), by 8 degrees:
cos 0 sin
sin 0)
A =
(13)
cos
Scaling, Sc(p), by p%6:
A
100
b
(14)
1
+
p
T00
Shearing, Sh(m), by shear factor m%:
1
1
+
m
0 0
A
100
(15)
0
Translation, T(z, y). by pixels horizontally and y pixels vertically:
0
0
A
b
(16)
0
0
B INTERPOLATION
Affine transformations may change pixel's integer coordinates into non-integer coordinates. Inter- polation is typically used to ensure that the resulting image can be represented on a lattice (integer) pixel grid. For this paper, will be using bilinear interpolation, common interpolation method which achieves good trade-off between accuracy and efficiency in practice and is commonly used in literature (Xiao
2018b Balunović et al.) 2019). Let Ti 4/,, represent the pixel value position i.j for the original and transformed image respectively. Let d',,j- di,, represent the c-coordiiate and y-coordinate of the pixel at i, after transformation. We define transformed image by summing over all pixels n, m E ... H]] x [1... W] where and W represent the height and width of the image.
H
W
Tn,m max 1
Id",, - ml) max 1 -Cc nl)
(17)
71
X
13

---

Under review as a conference paper at ICLR 2023
This interpolation can be computed for each channel in the image. While interpolation is typically not differentiable, order to generate adversarial examples using standard techniques we need differentiable version of interpolation. (Jaderberg et al., 2015) introduces differentiable image sampling. Their method works for any interpolation method as long as the (sub-)gradients can be defined with respect x. d'j.- For bilinear interpolation this becomes,
Ozl nxn.
Σ
max(0, IdT,, -ml) max(0, |d"", n2) Σ
(18)
if m
2 ce ml
Σ>
_
n.m max 1 Ic nl)
if (d ml
(19)
Ocj
otherwise
C SGD ALGORITHM
Our SGD UAP algorithm is based on standard momentum based SGD while optimizing over the objective proposed the algorithm details can be seen in Algorithm 3
Algorithm 3 Stochastic Gradient Descent UAP Algorithm
1: Initialize u, f- 0, Au, <
2: repeat
3: for B X do
4: Sample CT
5: Aur t adu, x Σ Σ VLIS(R) + &U,)), f(x))
6: Update the perturbation with projection:
7:
+- '-Pp.c(us Au,)
8: end for
9:
until (fRR(f (,,,f,,,,,,,..... <9
D ITERATIVE UAP ALGORITHM
Moosavi-Dezfooli et al. (017) introduces an iterative UAP algorithm, the algorithm can be seen in Algorithm
Algorithm 4 Iterative Universal Perturbation Algorithm (Moosavi-Dezfooll et al. (2017))
1: Initialize u 0
2: repeat
3: for x; E X do
4:
f(xi + u) = (xx) then
5:
Compute minimal adversarial perturbation:
6:
Au arg min, ||r||2 s.t. f(x * f(x))
7:
Update the perturbation with projection:
8:
+ Pu. Au)
9:
end if
end for
11:
until ASR (f,X, <9
E EXPERIMENT PARAMETERS
In experiments, have capped all algorithms at 5 epochs or if they have achieved ASR of 0.95. The UAPs are trained with the same transformation set that they are evaluated on. For algorithms running PGD internally, have capped the number of iterations to 40.
14

---

Under review as a conference paper at ICLR 2023
F
FURTHER EVALUATION OF UNIFORM NOISE
Results in T
STANDARD UA2
SGD
STANDARD UAP_RE
ROBUST
DATASET
TRANSFORMATION SET
UA2
ILSVRC
((0.1)
81.6%
94.2%
91.3%
99.0%
2012
(0.3)
10.7%
68.9%
42.7%
96.1%
U(0.1)
66. 06.0%
98.1% 96.1%
96.1%
100%
CIFAR-10
((0.3)
5.8%
47.6%
100%
Table 2: Robust ASR with uniform random noise, 7 0.8.
G UAP PERFORMANCE AGAINST SEMANTIC TRANSFORMATIONS ON
CIFAR-10
(a) R000,22,00001)
(b) R(2)Sh2
(c) (h().T(222),h((,SSssel 0.001)
100
% Samples
75
50
StandardUA
25
StandardUAP RF
RobustUAP
0
0.2
0.4
0.6
0.8
0
0.2
0.4
0.6
0.8
0
0.2
0.4
0.6
0.8
Universal ASR
Figure 6: For each method, a point (æ, y) in the corresponding line represents the percentage of sampled UAPs (y%) with Universal ASR for the different semantic transformations CIFAR- 10.
H AVERAGE ASRG AND ASRR WITH DIFFERENT '
We provide additional metrics computed the same set of transformations, datasets, and models as in T In Table 3] we present the Average ASR; rather than ASR The average shows us that average
RobustUAp algorithm creates UAPs which after transformation than all other algorithms. We observe that the average shows us that even standard UAPs aren't t completely ineffective after transformation they just have very low chance of being highly effective.
better UAPs
STANDARD UAP
SGD
STANDARD UAP RP
ROBUST UAP
DATASET TRANSFORMATION SET
R(20)
16.3%
71.5%
21.7%
81.3%
ILSVRC
T(2,2)
52.6%
82.6%
55.4%
85.4%
2012
Sc(5), R(5), B(5,
44.9%
76.3%
58.5%
82.2%
R(10), 222,2), Sh((), ((2)), 0.001)
13.6%
64.8%
29.0%
75.3%
R(30), ((2,0.001)
9.9%
66.8%
22.2%
73.4%
CIFAR-10
R(2), Sh(2) R(10), T(2. 2), Sh(2), Sc(2), B(2, 0.001)
57.1%
78.8%
61.2%
82.9%
16.2%
61.2%
32.6%
76.4%
Table 3: Average Universal ASR of our Robust UAP algorithms and the standard UAP (Moosavi- Dezfooli et al. 2017) method.
In Table 4 present ASR computed at y [0.5, 0.7] rather than y 0.6. This table shows similar story to above, and shows that our algorithm produces better results under a variety of success thresholds.
15

---

Under review as a conference paper at ICLR 2023
DATASET TRANSFORMATION SET
STANDARD
SGD
STANDARD
ROBUST
UA2
DAP_RF 0.5
UAP
0.5
0.7
0.5
0.7
0.7
0.5
0.7
R(20)
1.9%
0.0%
88.3%
58.3%
10.7%
1.0%
98.1%
76.7%
ILSVRC
[(2, 2) Sc(5), R(5), (.500.0
51.5%
21.4%
100% 84.5% 57.3%
23.3%
100%
91.3%
2012
38.8%
11.7%
96.1% 67.0% 64.1%
25.2%
99.0%
87.4%
R(10), T(2, 2), Sh Sc(2), (22, 0.001)
1.9%
0.0%
82.5% 38.8% 12.6%
1.0%
95. 1% 59.2%
R(30), B(2, 0.001)
1.0%
0.0%
80.6% 43.7% 12.6%
1.0%
93. 93.2% 49.5%
CIFAR-10 R(2), (h)
62.1%
22.3%
96.1 1% 68.9% 68.0%
30.1% 1%
99.0% 89.3%
B(2, R(10), [2, 2), Sh(2), ((2,, 0.001)
2.9% 0.0% 67 67.0% 38.8% 19.4%
1.0%
93 2% 55.3%
Table 4: Robust ASR of our Robust UAP algorithms and the standard UAP (Moosavi-Dezfooli et al. method with = [0.5, 0.7].
2017
DATASET
STANDARDUAP
SGD
STANDARDUAP RP
RORUSTUAP
ILSVRC 2012
95.5%
85.6%
82.3%
91.3%
CIFAR-10
96.2%
89.3%
84.0%
93.7%
Table 5: Universal ASR of our Robust UAP algorithms and the standard UAP method.
1 COMPARISON ON NON-ROBUST UNIVERSAL ASR METRIC
We compare robust UAPs to standard UAPs the non-robust universal ASR metric, see Table All robust UAPs are generated to be robust against R(10), T(2, 2). observe that at the same l2- norm all robust UAPs achieve lower universal ASR than the standard UAP algorithm. This result is not too surprising as solving the optimization problem for robust UAP is significantly effective in comparison to the other robust baseline approaches.
Sc(2), ( ((, 0.001). We
difficult. We further observe that RobustUAP algorithm the most
ADDITIONAL MODELS
We also provide additional data on our methods evaluated on the same transformations and datasets but on different models. In this case, (Howard et al.) 2017) for ILSVRC 2012. Results can be seen in Table 6 We observe similar performance across models suggesting that the performance of the attacks more directly tied to transformation set and dataset.
ResNet- 18 (He et al. 2015) for CIFAR-10 and MobileNet
STANDARD
SGD
STANDARD UAP_R2
ROBUST
DATASET
MODEL
TRANSFORMATION SET
UAP
UAP
R(20) MOBILENET T(2,2)
8.1%
71.2%
2.6%
85.0%
ILSVRC
40.9%
98.7%
54.3%
99.6%
2012
Sc(5), R(5), (5,, 0.01)
16.3%
94.5%
44.3%
96.3%
S(()) ((2.0)
4.1%
75.7%
8.6%
86.2%
R(30), B22, 0.001) R(2), Sh(2) R(10), (2, 2). S((2),, B(2.0.00)
0.9%
67.8%
6.4%
74.9%
CIFAR-10 RESNET-18
49.9%
99.5%
49.1%
99.8%
8.0%
70.8%
12.2%
83.8%
Table 6: Robust ASR Resnet-18 18 for CIFAR-10 and MobileNet for ILSVRC 2012.
K COMMON CORRUPTIONS
We also evaluate robust UAP against the 2D fog transformations (Kar et al. 2022). We set the shift intensity of the fog to be and train robust UAPs to be robust against random fog perturbations. We observe similar results to the transformations we experiment with above. The graph of the results can be seen in Figure
16

---

Under review as a conference paper at ICLR 2023
Figg
100
% Samples
75
50
StandardUAP
25
SGD
StandardUAP
RP
RobustUAP
0.2
0.4
0.6
0.8
Universal ASR
Figure 7: For each method, a point (z, y) in the corresponding line represents the percentage of sampled UAPs (y%) with Universal ASR >> æ for the different semantic transformations on ILSVRC- 2012.
L ALGORITHM RUNTIMES
compare the average runtimes the different methods on one our most challenging R(10), (2,, 2), Sh(2), Sc(2), B(2, 0.001) transformation set on ILSVRC-2012 and 738. The results are Table We observe that RobustUAP is the slowest algorithm and SGD is the fastest. Est i ImateRobustmt more time to compute. The extra computation enables Robust UAP to obtain better robustness than all baselines. On the same of transformations and dataset we observe that one iteration of
RobustUAP
in each loop and thus with high it requires much
on the entire test set takes on average 19 minutes. When running Est imateRobustness in the RobustUAP loop, each call takes 36 seconds for batch size of 32.
ALGORITHM
TIME(MIN)
STANDARD UAP
SGD STANDARD UAP_RP
32
43
ROBUST UAP
118
Table Average Runtime for Robust UAP algorithms
M EFFECT OF COMPUTE TIME ON ROBUSTNESS
Previous sections highlight SGD as the most competitive algorithm to RobustUAE in terms of performance. However, the previous section we note that SGD takes significantly less time to run. In this section, we investigate how RobustUAP performs with limited compute time as well as how SGD performs with increased runtime. We first add results the ILSVRC 2012 part of Table by also computing RobustUAP performance when limited to the same amount of time that SGD takes. Table g shows that Robust CAP outperforms SGD even when its compute time is limited with up to 9% more robustness most challenging transformation R 2100), (22, 2), (2) Sc 0.001).
SGD
RoBusT UAP
RESTRICTED RosuST UAP
DATASET TRANSFORMATION SET
R(20)
69.9%
93.2%
72.9%
ILSVRC 2012
T(2, 2)
96.1%
97.1%
96.9%
Sc(5), R(5), B(5, 0.01)
85.1%
96.1%
86.3%
R(10), T Sh(2), Sc(2), B(2, 0.001)
63.1%
86.4%
72.0%
Table 8: Robust ASR of Robust restricted to the same amount of compute time as SGD.
17

---

Under review as a conference paper at ICLR 2023
Next, we vary the number of SGD iterations. We compute the robust ASR ILSVRC for robustness against R(10), T(2, 2). Sh(2), (2, B 0.001). Figure shows the robust ASR achieved by SGD over time, here observe that SGD's performance flatlines after small number of iterations and seems to be unable to surpass about 65. Here SGD is allowed to continue to run past where would usually stop (at around 250 iterations), in this experiment which is about the same amount of time that Robust UAP takes to run. RobustUAP is able to 72 even when restricted to the amount of compute time of base SGD (It achieves 86.4 when unrestricted). These two results in combination show that Robust UAP is able find more robust UAPs than SGD whose performance stabilizes.
allow it to go to 1250 iterations
achieve a performance
SGD Performance Time
60
Robust ASR
40
20
0
200
400
600
800
1000
1200
Number of Iterations
Figure 8: The Robust ASR with y = 0.6 for SGD over time
N ROBUSTNESS ON HOLD-OUT TRANSFORMATIONS
In this section, we measure the effectiveness of our robust UAPs against hold-out transformations. In this experiment, learn UAP which is robust R(5) and obtain robust ASR of 96.2 at 0.6. We then measure its effectiveness against Sc(5) and get robust ASR of 85.4, in contrast, a robust UAP trained directly be robust Sc(5) obtains robust ASR of 98.1. Next, measure the robustness of UAP trained against ((55) when subjected to transformations from B(5, 0.01). Here we get a robust ASR of 97.3, whereas a robust UAP trained be robust (5,, 0.01) obtains robust ASR of 99.2. Finally, we test the robust UAP on R(5), Sc(5), (5,, 0.01) and get robust ASR of 83.1. Our previous results show that a UAP trained to be robust against these parameters directly can obtain robust ASR of 1..1. In each case, our UAP maintains robustness on hold-out transformations but has lower performance compared to robust UAPs trained directly to be robust to those transformations.
O TARGETED ATTACK
So far in this paper we have focused untargeted attacks, i.e. attacks which aim to degrade the general performance of the model. Targeted attacks are also possible with both standard adversarial at- tack methods and universal adversarial perturbation methods. Here, we can simply turn our algorithm from untargeted to targeted by replacing the loss function. We would like to have target class, A, be classified as target class, B. Instead of maximizing the expected value of the cross entropy loss we can instead formulate the loss based on maximizing B while minimizing A similar to (Benz et al., 2020). For ILSVRC 2012, we randomly select a couple of target classes and perform this attack, for each of these cases, we train our robust UAP to be robust to RR( ((2, Sh(2), Se(2), B(2 0.001). Table shows our results for robust ASR with = 0.6. We are measuring our robust ASR of turning class A into class B and observe similar results with RobustUAS being the most robust followed by SGD. It is also interesting to note that different random combinations lead to more or less success, i.c. it is easier turn dog into another dog than perfume into padlock.
18

---

Under review as a conference paper at ICLR 2023
DATASET
TARGET CLASS
STANDARD
SGD
STANDARD
ROBUST
UAP
JAP RPP
UAP
TOY POODLE MALTESE
42.4% 0.0%
99.1% 63.8%
85.6% 5.1%
99.8% 76.4%
ILSVRC-2012
PERFUME PADLOCK
Table 9: Robust ASR of RobustUAF for target to target attack compared to the three baselines with 7 0.6.
P DATA EFFICIENCY
In this section, will evaluate the data efficiency of RobustUAP. We use RobustUAP generate 0.001) on ILSVRC-2012 with differing amounts
UAPs robust to R(10) T(2, 2), Sc(2), (2, of training data. The results can seen Figure 2 These results show that the algorithm is able to achieve good performance at 500 data points but continues to improve up to 4000 data points. After that it seems stagnate.
RobustUAP Performance Training Dataset Size
80
Robust ASR
60
40
20
1000
2000
3000
4000
5000
Training Dataset Size
Figure 9: Robust ASR with 0.6 for RobustUAP with differing amounts of training data
Q TRANSFERABILITY
In this section, we will evaluate the transferability of RobustUAP. Previous works on UAPs (Moosavi-Deztooli et al., (017) show that UAPs are transferable across different models. Here, we will evaluate whether robust UAPs exhibit the same behavior for robustness. The robust UAPs studied here are generated with RobustUAP for ILSVRC-2012 with y 0.6. We use a variety of models: Inception-vàs Szzgedy et al. 2016). Mo- bileNet (Howard et al. 2017), Inception-v2 trained to be robust R(20) (Inception R20). Inception- v3 trained to be robust on horizontal flips (InceptionH-IF), and ViT (Dosovitskiy et al. 2020). Table TO shows that robust UAPs are transferable between different architectures. Our results show that robust UAPs transfer their robustness properties between architectures and models. Ignoring VIT, on all of the Inception and MobileNet models, the generated UAPs maintain least 65% robust ASR when transferred to each other. This transfer is less but still significant for VIT where it maintains at least 32% robustness when transferred to or from the other models.
R(110),T(2, 2), Sh(2), Sc(2), ( 0.001)
TARGET MODEL
SOURCE MODEL
INCEPTION
MOBILENET
INCEPTIONR20
INCEPTIONHE
VIT
INCEPTION
86.4%
65.2%
75.2%
78.5%
35.1%
MOBILENET
74.3%
86.2%
67.3%
68.6%
38.3%
INCEPTIONR20
80.1%
67.3%
81.3%
73.1%
32.0%
INCEPTIONHE
77.8% 41.2%
70.9%
75.8%
83.8%
34.6%
VIT
32.4%
43.2%
39.7%
88.5%
Table 10: Robust ASR when UAP is learned on source model and transfered to target model.
19

---

Under review as a conference paper at ICLR 2023
R TRANSFORMER-BASER MODELS
Recently, transformers have become popular as a new architecture for deep learning models for computer vision tasks. In this section, we evaluate the effectiveness of robust UAPs against one such model, VIT (Dosovitskiy et al. 2020). Benz et al. (202T) has shown that standard UAPs are still effective against transformer based architectures. In Table 11 we can see that we get similar results compared to our results on Inception and MobileNet. This shows that our methods work against transformer based models as well.
STANDARD UAP
SGD
STANDARD
RORUST
DATASET
MODEL TRANSFORMATION SET
UAP_
UAP
ILSVRC-2012 VIT
R(10), 2). S22)), B(2 0.001)
2.0%
72.1%
12.9%
88.5%
Table 11: Robust ASR of Robust to the three baselines for VIT.
S ROBUST UAPS AGAINST ROBUSTLY TRAINED NETWORKS
In this section, we are interested in seeing whether training networks to be robust against the same transformations that the UAP is trying to be robust against is helpful. For this, we trained two new Inception-v3 networks. Because of time limitations, we started with our base Inception-v3 network and fine-tuned it using data augmentations. For the first network InceptionR20, we augmented the data by adding random rotations within 20 degrees. For the second network InceptionHIF, we augmented the data by adding horizontal flips. We then crafted UAPs robust against rotations and flips on InceptionR20 and InceptionHF respectively. The results can be seen in Table [2] We can compare the R(00) results those from our normal inception network. We postulate that since the network has received some additional robustness training it is harder to attack, and thus we should see slightly lower robustness scores. However, it seems that training the network to be robust R(20) does not significantly effect the ability to create robust UAPs. The horizontal flips seems like it might be too easy of a transformation as even standard UAP performs quite well for robust ASR.
STANDARD UAP
SGD
STANDARD ROBUST
DATASET
MODEL
TRANSFORMATION SET
UAP RP
UAP
INCEPTIONR20 R(20) INCEPTIONHF HF
6.3%
72.4%
10.2% 39.7%
81.3% 99.6%
ILSVRC-2012
81.3%
99.5%
Table 12: Robust ASR of Robust compared to the three baselines for robust networks.
T ABLATION ON OPTIMIZATION STRATEGY
In this section, we study the effect of using different optimizers in addition to SGD. We use a variety of standard Py Torch optimizers, Adam, Adamax, Adagrad, and RMSProp. We formu- late the optimization problem the same way but instead use these algorithms in order to op- timize our perturbation. We compute these results on ILSVRC-2012 with Inception-v3 and use R(10), (2, Sh(2), Sc(2), B(2, 0.001) as the transformation set and with 7 = 0.6. The results can be seen in Table 13 We see that the optimization strategy has some affect on the results and that SGD performs the best. We also found that SGD performed marginally faster than the rest of the approaches.
OPTIMIZER ASHR
SGD
63.1% %
ADAM
59.7%
ADAMAX
60.1%
ADAGRAD
62.3%
RMSPROP
58.3%
Table 13: Comparison of different optimization strategies.
20


Reviews:
[{"review_id": "oZKbLD-CwU", "reviewer": "Reviewer_BeFR", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a robust universal adversarial perturbation which is robust to many transformations such as rotation, pixel intensity. It proposes a robustness estimation approach which can be leveraged to conduct adversarial attack.", "summary_of_the_review": "The problem discussed in this paper is important when applying universal perturbation attack to real-world physical attack. But my concerns are the limited novelty and experimental evaluation, thus it needs to be significantly improved before being accepted. ", "strength_and_weaknesses": "positives:\n+ it is important to improve the robustness of universal perturbation, especially when applying them in physical attack. \n\n\nnegatives:\n- the proposed method is straightforward since it just combines the idea of physical attack and digital universal perturbation attack.\n- But experiments conducted in this paper almost focus on the digital domain, instead of real-world physical transformation. Due to that, it is hard to measure the effectiveness of the proposed method. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "DTtkfkliB5_", "reviewer": "Reviewer_pw3U", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper presents a simple improvement to universal adversarial perturbations to make them robust to transformations.  The paper motivates empirical experiments via theoretical observations.", "summary_of_the_review": "I like the simplicity of the approach and the empirical robustness gains, but the presentation is hard to follow, and there are numerous experiments missing that would have been a better use of space than the theory.", "strength_and_weaknesses": "How does the ability to craft perturbations which are robust under transformations depend on the invariance properties of the victim network to such transformations?  For example, is it easier to craft UAPs which are robust to horizontal flips for models trained with horizontal flip data augmentations.  How does this depend on the model used for crafting as well?\n\nThis paper contains virtually no ablations, for example on the choice of optimizer in the attack.  The authors use a different optimization strategy for example in the SGD baseline instead of PGD, so that is important to ablate.\n\nMy biggest qualm with this work is that the paper is packed with theory and notation, yet the proposed method is extremely simple and does not require any of the theory for motivation.  In fact, while I was reading the theory, I wrote down a note to myself asking if the authors tried a very simple and obvious baseline, and that baseline turned out to be exactly their proposed method.  The technique of EOT is widely used in the adversarial example and poisoning literature, for example, so it makes sense to use it here as well.  Simplicity is a good thing as simple methods are easier to understand and implement, but loading up a paper with entirely unnecessary theory and notation so that it is harder for the reader to understand the work defeats the purpose.  The algorithm only appears on page 6 of 9 in a method paper.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "5mIevFkHexn", "reviewer": "Reviewer_jAxg", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work introduces robust Universal Adversarial Perturbations (UAPs). The objective of robust UAPs is to increase the resilience of UAPs against image transformations. Robust UAPs are obtained by incorporating transformation functions into the UAP generation process. Evaluation on CIFAR10 and ImageNet demonstrate the increased performance of robust UAPs compared to baseline approaches. ", "summary_of_the_review": "While it is indeed true that the efficiency of UAPs suffers under transformations, simply showing that this can be mitigated by introducing transformations into the crafting process does in my opinion not hold enough contribution to be accepted at ICLR. Additionally, as pointed out in my weaknesses section, this work lacks several crucial evaluations to fully judge the effectiveness of the proposed robust UAPs.  ", "strength_and_weaknesses": "## Strengths\n(+) This work deals with the topic of the robustness of Universal Adversarial Perturbations (UAPs). This is an important topic, since, as the authors demonstrate, the effectiveness of UAPs decreases under image transformations.  \n(+) The provided experimental results are convincing, showing that the proposed method outperforms the compared baselines.  \n\n## Weaknesses\n(-) The contribution of this work is limited. In essence, this work shows that to overcome the susceptibility of UAPs to transformations, transformations need to be incorporated into the UAP crafting process. The increased robustness is hence expected.  \n(-) The proposed algorithm has only limited novelty and is a collection of proven methods in the literature, namely batch-training [A, B], expectation over transformations [Athalye et al., 2018], and PGD [Madry et al., 2017]. It would be beneficial if the authors could differentiate their algorithm from the ones in the literature [Shafahi et al., 2020, A, B].  \n(-) To further demonstrate the robustness of the UAP, the authors should evaluate the robust UAPs on hold-out transformation, which were not observed during training.  \n(-) The authors mainly evaluated the robust UAP in the context of untargeted attack success rate. It would be further interesting to see a performance evaluation of the targeted attack success rate.  \n(-) I am further curious about the data efficiency and transferability of robust UAPs.  \n* Data efficiency: How do robust UAPs perform when only limited data is accessible during the training process? Please also note, that in the literature data-free methods exist.  \n* Transferability: It is common to analyze the transferability of UAPs [Moosavi-Dezfooli et al. 2017, A, B, C]. I would be curious about the transferability of robust UAPs, compared to existing methods.   \n\n(-) The authors mainly evaluated robust UAPs on VGG, Inception, and ResNet18. Recently, transformer architectures gained popularity. I am curious if the concept of robust UAPs holds for transformer-based models as well.  \n(-) The related work section is insufficient. To name only a few missing works: [A-E].  \n\n[A] Generalizable Data-free Objective for Crafting Universal Adversarial Perturbations; T-PAMI 2018  \n[B] Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations; CVPR 2020  \n[C] Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses; ECCV 2020  \n[D] Art of singular vectors and universal adversarial perturbations; CVPR 2018  \n[E] Defense against Universal Adversarial Perturbations; CVPR 2018  \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "5OrvxBwsAJJ", "reviewer": "Reviewer_CA3y", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors consider the problem of making universal adversarial perturbations (UAPs - those that can be applied to any input and trigger classification for a certain class) under a set of transformations. The authors present a new algorithm. It involves applying SGD over  examples (in the outer loop) and randomly chosen transformations (in the inner loop). The caveat is that for each batch the algorithm estimates robustness (i.e. adversarial success rate under the transformation set) in the optimization loop, allowing the algorithm to move on to the next batch only after the resulting UAPs are estimated to be robust to a certain level. It turns out that in practice this algorithm has higher adversarial success rate than just performing SGD alone, especially on complex sets of transformations.", "summary_of_the_review": "A well written paper that tackles an important problem with new ideas. The only lacking aspect is extensive baselines. My score will increase if the authors run more extensive baselines.", "strength_and_weaknesses": "Strengths: the method outperforms baselines on adversarial success rate, especially under large sets of transformations.\n\nWeaknesses: the SGD baseline is underspecified. It would be interesting to see the extent to which the presented algorithm outperforms SGD while contextualizing compute used. Some questions: \n* How much compute is used to perform RobustUAP compared to SGD?\n* How much compute is used to obtain robustness estimates?\n* What happens when this same amount of compute is used to run SGD?\n* What happens as you vary the number of SGD iterations? Does SGD improve its ASR or does it just asymptote?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject