---
abstract: 'Given a state-of-the-art deep neural network classifier, we show the existence of a (image-agnostic) and very small perturbation vector that causes natural images to be misclassified with high probability. We propose a systematic algorithm for computing universal perturbations, and show that state-of-the-art deep neural networks are highly vulnerable to such perturbations, albeit being quasi-imperceptible to the human eye. We further empirically analyze these universal perturbations and show, in particular, that they generalize very well across neural networks. The surprising existence of universal perturbations reveals important geometric *correlations* among the high-dimensional decision boundary of classifiers. It further outlines potential security breaches with the existence of single directions in the input space that adversaries can possibly exploit to break a classifier on most natural images.[^1]'
author:
- |
    Seyed-Mohsen Moosavi-Dezfooli[^2][^3]\
    [seyed.moosavi@epfl.ch]{}
- |
    Alhussein Fawzi\
    [alhussein.fawzi@epfl.ch]{}
- '\'
- |
    Omar Fawzi[^4]\
    [omar.fawzi@ens-lyon.fr]{}
- |
    Pascal Frossard\
    [pascal.frossard@epfl.ch]{}
bibliography:
- 'bibliography.bib'
title: Universal adversarial perturbations
---

Acknowledgments {#acknowledgments .unnumbered}
---------------

We gratefully acknowledge the support of NVIDIA Corporation with the donation of the Tesla K40 GPU used for this research.

[^1]: To encourage reproducible research, the code is available at [gitHub](https://github.com/LTS4/universal). Furthermore, a video demonstrating the effect of universal perturbations on a smartphone can be found [here](https://youtu.be/jhOu5yhe0rc).

[^2]: The first two authors contributed equally to this work.

[^3]: École Polytechnique Fédérale de Lausanne, Switzerland

[^4]: ENS de Lyon, LIP, UMR 5668 ENS Lyon - CNRS - UCBL - INRIA, Université de Lyon, France
