# Targeted Universal Adversarial Examples for Remote Sensing
## 3 Methodology
### Source-Targeted Universal Adversarial Examples
#### 3.2.2 Loss Design  
Source-targeted universal adversarial attacks, which are different from targeted universal adversarial attacks targeting all of the images, are only for the specified classes and have no or little effects on other classes. Source-targeted universal adversarial attacks are two-fold. First, with the class-specific perturbations \(\delta_{ct}\), images from class \(s\) would be predicted by the victim model \(f\) as the target class \(t\). Second, images from other classes with \(\delta_{ct}\) can be classified correctly by \(f\). Thus, the overall loss source-targeted universal adversarial attacks \(\mathcal{L}_{st}\) consists of two parts: the loss for class \(s\)--\(\mathcal{L}_{s}\) and the loss for other classes --\(\mathcal{L}_{other}\).  
Specifically, \(\mathcal{L}_{s}\) is defined as  
\[\mathcal{L}_{s}(f,x_{s},t,\delta_{ct})=\mathbb{E}_{(x_{s},y_{o})\sim\mathcal{ D}}[\mathcal{L}_{ce}(\theta,x_{s}+\delta_{ct},t)]. \tag{13}\]  
The loss \(\mathcal{L}_{other}\) involves maintaining the performance of the victim model \(f\) on images from other classes when added \(\delta_{ct}\). Thus, we have \(\mathcal{L}_{other}\) expressed as  
\[\mathcal{L}_{other}(f,x_{o},y_{o},\delta_{ct})=\mathbb{E}_{(x_{o},y_{o})\sim \mathcal{D}}[\mathcal{L}_{ce}(\theta,x_{o}+\delta_{ct},y_{o})]. \tag{14}\]  
Considering that \(f\) can never be perfect to classify all images correctly, we instead replace the true label \(y_{o}\) with the victim model's predictions \(f(x_{o})\) in \(\mathcal{L}_{other}\). Thus, the new \(\mathcal{L}_{other}\) is rewritten as  
\[\mathcal{L}_{other}(f,x_{o},\delta_{ct})=\mathbb{E}_{(x_{o},y_{o})\sim\mathcal{ D}}[\mathcal{L}_{ce}(\theta,x_{o}+\delta_{ct},max(f(x_{o})))]. \tag{15}\]  
Then we have \(\mathcal{L}_{st}\) as the sum of \(\mathcal{L}_{s}\) and \(\mathcal{L}_{other}\),  
\[\mathcal{L}_{st}=\mathcal{L}_{s}+\alpha\times\mathcal{L}_{other}, \tag{16}\]  
where \(\alpha\) is a hyperparameter for balancing these two losses. The training details are summarized in Algorithm 2.  
```
0: Dataset \(\mathcal{D}\), Victim model \(f\), Specified class \(s\), Targeted class \(t\), Loss function \(\mathcal{L}_{tu}\), Number of iterations \(I\), Perturbation magnitude \(\epsilon\), hyperparameter \(\alpha\)  initialize \(\delta_{ct}\sim\mathcal{N}(0,1)\)\(\triangleright\) Random initialization while\(i<I\)do  sample \((X,Y)\in\mathcal{D}\)\(\triangleright\) Mini batch \(X_{adv}=X+\delta_{ct}\)\(\triangleright\) Craft adversarial examples \(M=\{1|Y=s\}\)\(\triangleright\) Generate mask \(X_{s}=X\cdot M\)\(\triangleright\) Select specified class samples \(X_{o}=X\cdot(1-M),Y_{o}=Y\cdot(1-M)\)\(\triangleright\) Select other class samples \(\mathcal{L}_{st}=\mathcal{L}_{s}(f,X_{s},t,\delta_{ct})+\alpha\times\mathcal{L}_ {other}(f,X_{o},Y_{o},\delta_{ct})\)\(\triangleright\) Calculate loss \(g_{\delta_{t}}=\
abla\mathcal{L}_{st}(f,X_{s},X_{o},Y_{o},t,\delta_{ct})\)\(\triangleright\) Calculate gradients \(\delta_{ct}=\operatorname*{Optim}(g_{\delta_{ct}})\)\(\triangleright\) Update \(\delta_{ct}\)\(\delta_{ct}=\frac{\delta_{ct}}{\|\delta_{ct}\|_{p}}\epsilon\)\(\triangleright\) Projection endwhile
```  
**Algorithm 2** Source-targeted universal attack.