Towards Robust Universal Perturbation Attacks: A Float-Coded, Penalty-Driven Evolutionary Approach

TL;DR

This work tackles universal adversarial perturbations (UAPs) by framing their generation as a gradient-free search using a float-coded, penalty-driven evolutionary algorithm. The method employs a single-objective fitness with a soft penalty $F=\Gamma-\lambda\max(0,\|\Delta\|-\epsilon)$, along with dynamic operator scheduling, nonelitist selection, a pixel-cleaning policy, and batch-switching to promote cross-model universality. Key contributions include transitioning from integer to float genes, implementing an exponential decay on the constraint $\epsilon$, and a modular PyTorch-based implementation tested on GoogLeNet, ResNet-50, and ViT-B/16 on ImageNet-1K, achieving smaller perturbation norms while maintaining high misclassification rates. Empirically, the approach reduces the final perturbation norm from $\sim 110$ to $\sim 40$, yields average MSE $< 50$, and attains faster convergence compared with prior EUPA methods, demonstrating robustness and scalability across architectures.

Abstract

Universal adversarial perturbations (UAPs) have garnered significant attention due to their ability to undermine deep neural networks across multiple inputs using a single noise pattern. Evolutionary algorithms offer a promising approach to generating such perturbations due to their ability to navigate non-convex, gradient-free landscapes. In this work, we introduce a float-coded, penalty-driven single-objective evolutionary framework for UAP generation that achieves lower visibility perturbations while enhancing attack success rates. Our approach leverages continuous gene representations aligned with contemporary deep learning scales, incorporates dynamic evolutionary operators with adaptive scheduling, and utilizes a modular PyTorch implementation for seamless integration with modern architectures. Additionally, we ensure the universality of the generated perturbations by testing across diverse models and by periodically switching batches to prevent overfitting. Experimental results on the ImageNet dataset demonstrate that our framework consistently produces perturbations with smaller norms, higher misclassification effectiveness, and faster convergence compared to existing evolutionary-based methods. These findings highlight the robustness and scalability of our approach for universal adversarial attacks across various deep learning architectures.

Figures (2)

• Figure 1: Perturbation at generations 1, 16, 32, 48, and 64. The first column shows 4 images taken from the ImageNet dataset, and the second to sixth columns show the same images with perturbations superimposed on top. The curtailment of the perturbation magnitude is very apparent, with the noise almost converging after generation 48. Furthermore, the misclassification score actually increases from 0.5156 to 0.5469 in interactions from gen. 1 to gen. 64; showing an increase in effectiveness while making the perturbation less visible. Just for illustration purposes, we periodically adjust the image batch to prevent overfitting.
• Figure 2: (a) Perturbation Norm: L2 Norm of the universal adversarial perturbation over 64 generations (b) Average Mean Squared Error (MSE): Average MSE between the original image and the attacked image (with perturbation superimposed on top). This is computed in the [0, 255] unnormalized image domain. (c) Misclassification Rate: Rate of misclassification on the batch of 64 images (with a new batch loaded every 4 generations) (d) Average Confidence Score: The average confidence score of the model on correct labels on each batch of 64 images.