# Simple Iterative Method for Generating Targeted Universal Adversarial Perturbations
## 3 Results and Discussion
### Case of ImageNet Models  
For the ImageNet models, we used the validation dataset used in the ImageNet Large Scale Visual Recognition Challenge 2012 (ILSVRC2012; www.image-net.org/challenges/LSVRC/2012/) to generate the targeted UAPs. The dataset is comprised of 50,000 images (50 images per class). We used 40,000 images as the input images. The input image set was obtained by randomly selecting 40 images per class. The rest (10,000 images; 10 images per class) was used as test images for evaluating the UAPs. The parameters \(e\) and \(i_{\text{max}}\) were set to 0.5 and five, respectively. In this study, we considered targeted attacks for three classes (golf ball, broccoli, and stone wall) that were randomly selected from 1000 classes in a previous study [17], to avoid redundancy. We generated targeted UAPs with \(\zeta=6\%\) (\(\zeta=3000\)) and \(\zeta=8\%\) (\(\zeta=4000\)). The target attack success rates \(r_{\text{ts}}\) were between \(\sim\)30% and \(\sim\)75% and between \(\sim\)60% and \(\sim\)90% when \(\zeta=6\%\) and \(\zeta=8\%\), respectively (Table 1). The success rates for the input images were almost similar to those for the test images, indicating no overfitting of the generated UAPs to the input image set. The success  
Figure 2: Targeted UAPs (top panel) with \(\zeta=5\%\) against the VGG-20 model for the CIFAR-10 dataset and their adversarial attacks for an original (i.e., non-perturbed) image (left panel) randomly selected from the images that, without perturbation, was correctly classified into each source class and, with the perturbations, correctly classified into the target classes: airplane (0), automobile (1), bird (2), cat (3), deer (4), dog (5), frog (6), horse (7), ship (8), and truck (9). Note that the UAPs are emphatically displayed for clarity; in particular, each UAP was scaled with the maximum of one and the minimum of zero. rates of the targeted UAPs were significantly higher than those of random UAPs, which were less than 1% in all cases. This indicates that non-random patterns are required for targeted attacks  
A higher perturbation magnitude \(\zeta\) led to a higher targeted attack success rate \(r_{ts}\). The success rates \(r_{ts}\) depend on the image classes. For example, the targeted attacks for the class \"golf ball\" were more easily achieved than those for the class \"broccoli\". The success rates \(r_{ts}\) also depended on the DNN architectures; in particular, the ResNet-50 model was more easy to fool than the VGG models. Overall, however, we confirmed that the proposed method was applicable to various DNN architectures. The targeted UAPs with \(\zeta=6\%\) and \(\zeta=8\%\) were almost imperceptible (Figure 3); however, they were partly perceptible for whitish images (e.g., trimaran). Moreover, the UAPs seem to reflect object shapes of each target class. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Target Class**} & \multirow{2}{*}{**Model**} & \multicolumn{2}{c}{\(\boldsymbol{\zeta=6\%}\)} & \multicolumn{2}{c}{\(\boldsymbol{\zeta=8\%}\)} \\  & & **Input** & **Test** & **Input** & **Test** \\ \hline \multirow{3}{*}{Golf ball} & VGG-16 & 58.0\% & 57.6\% & 81.6\% & 80.6\% \\  & VGG-19 & 55.3\% & 55.2\% & 81.3\% & 80.1\% \\  & ResNet-50 & 66.8\% & 66.5\% & 90.3\% & 89.8\% \\ \hline \multirow{3}{*}{Broccoli} & VGG-16 & 29.3\% & 29.0\% & 59.7\% & 59.5\% \\  & VGG-19 & 31.2\% & 30.5\% & 59.7\% & 59.4\% \\  & ResNet-50 & 46.4\% & 46.6\% & 74.6\% & 73.9\% \\ \hline \multirow{3}{*}{Stone wall} & VGG-16 & 47.1\% & 46.7\% & 75.0\% & 74.5\% \\  & VGG-19 & 48.4\% & 48.1\% & 73.9\% & 72.9\% \\ \cline{1-1}  & ResNet-50 & 74.7\% & 74.4\% & 92.0\% & 91.3\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Targeted attack success rates \(r_{ts}\) of targeted UAPs against the DNN models for each target class. \(r_{ts}\) for input images and test images are shown.