# Simple Iterative Method for Generating Targeted Universal Adversarial Perturbations
## 2 Materials and Methods  
### Targeted Universal Adversarial Perturbations  
Our algorithm (Algorithm 1) for generating UAPs for targeted attacks is an extension of the simple iterative algorithm for generating UAPs for non-targeted attacks [10]. Similar to the non-targeted UAP algorithm, our algorithm considers a classifier \(C(\mathbf{x})\) that returns the class or label (with the highest confidence score) for an input image \(\mathbf{x}\). The algorithm starts with \(\mathbf{\rho}=\mathbf{0}\) (no perturbation) and iteratively updates the UAP \(\mathbf{\rho}\) under the constraint that the \(L_{p}\) norm of the perturbation is equal to or less than a small value \(\xi\) (i.e., \(\|\mathbf{\rho}\|_{p}\leq\xi\)) by additively obtaining an adversarial perturbation for an input image \(\mathbf{x}\), which is randomly selected from an input image set \(\mathbf{X}\) without replacement. These iterative updates continue up till the termination conditions have been satisfied. Unlike the non-targeted UAP algorithm, our algorithm uses the fast gradient sign method for targeted attacks (tFGSM) to generate targeted UAPs, whereas the non-targeted UAP algorithm uses a method (e.g., DeepFool [7]) that generates a non-targeted adversarial example for an input image. tFGSM generates a targeted adversarial perturbation \(\psi(x,y)\) that causes an image \(x\) to be classified into the target class \(y\) using the gradient \(\
abla_{x}\mathcal{L}(x,y)\) of the loss function with respect to pixels [3; 20]. The gradient can be computed efficiently using backpropagation (i.e., by computing the chain rule backwards) [3]. Specifically, the forward pass computes values from the inputs (pixels) to the output. The backward pass then performs backpropagation that starts at the end of the DNN with the loss value based on the output and recursively applies the chain rule to compute the gradients all the way to the inputs. For the \(L_{\infty}\) norm, the perturbation is calculated as:  
\[\psi(x,y)=-\epsilon\cdot\text{sign}\left(\
abla_{x}\mathcal{L}(x,y)\right), \tag{1}\]  
where \(\epsilon\) (\(>0\)) is the attack strength. For the \(L_{1}\) and \(L_{2}\) norms, the perturbation is obtained as:  
\[\psi(x,y)=-\epsilon\frac{\
abla_{x}\mathcal{L}(x,y)}{\|\
abla_{x}\mathcal{L}( x,y)\|_{p}}. \tag{2}\]  
The adversarial example \(\mathbf{x}_{\text{adv}}\) is obtained as follows:  
\[\mathbf{x}_{\text{adv}}=\mathbf{x}+\psi(\mathbf{x},y). \tag{3}\]  
At each iteration step, our algorithm computes a targeted adversarial perturbation \(\psi(\mathbf{x}+\mathbf{\rho},y)\), if the perturbed image \(\mathbf{x}+\mathbf{\rho}\) is not classified into the target class \(y\) (i.e., \(C(\mathbf{x}+\mathbf{\rho})\
eq y\)); however, the non-targeted UAP algorithm obtains a non-targeted adversarial perturbation that satisfies \(C(\mathbf{x}+\mathbf{\rho})\
eq C(\mathbf{x})\) if \(C(\mathbf{x}+\mathbf{\rho})\ =\ C(\mathbf{x})\). After generating the adversarial example at this step (i.e., \(\mathbf{x}_{\text{adv}}\leftarrow\mathbf{x}+\mathbf{\rho}+\mathbf{\psi}(\mathbf{x}+\mathbf{\rho},y)\)), the perturbation \(\mathbf{\rho}\) is updated if \(\mathbf{x}_{\text{adv}}\) is classified into the target class \(y\) (i.e., \(C(\mathbf{x}_{\text{adv}})\ =\ y\)), whereas the non-targeted UAP algorithm updates the perturbation \(\mathbf{\rho}\) if \(C(\mathbf{x}+\mathbf{\rho})\
eq C(\mathbf{x})\). Note that tFGSM does not ensure that adversarial examples are classified into a target class. When updating \(\mathbf{\rho}\), a projection function \(\text{project}(\mathbf{x},p,\xi)\) is used to satisfy the constraint that \(\|\mathbf{\rho}\|_{p}\leq\xi\) (i.e., \(\mathbf{\rho}\leftarrow\text{project}(\mathbf{x}_{\text{adv}}-\mathbf{x},p,\xi)\).