Although deep neural networks (DNNs) have been shown to be susceptible to image-agnostic adversarial attacks on natural image classification problems, the effects of such attacks on DNN-based texture recognition have yet to be explored. As part of our work, we find that limiting the perturbation’s$l_{p}$norm in the spatial domain may not be a suitable way to restrict the perceptibility of universal adversarial perturbations for texture images. Based on the fact that human perception is affected by local visual frequency characteristics, we propose a frequency-tuned universal attack method to compute universal perturbations in the frequency domain. Our experiments indicate that our proposed method can produce less perceptible perturbations yet with a similar or higher white-box fooling rates on various DNN texture classifiers and texture datasets as compared to existing universal attack techniques. We also demonstrate that our approach can improve the attack robustness against defended models as well as the cross-dataset transferability for texture recognition problems.

It has been shown that there exist small and image-independent perturbations, called universal perturbations, that can fool deep-learning-based classifiers, resulting in a significant decrease in classification accuracy. In this paper, we propose a novel method to compute more effective universal perturbations via enhanced projected gradient descent on targeted classifiers. By maximizing the original loss function of the targeted model, we update the adversarial example with back-propagation and optimize the perturbation by accumulating small updates on perturbed images consecutively. We generate our attack for several modern CNN classifiers using ImageNet and compare the attack performance with other state-of-the-art universal adversarial attack methods. Performance results show that our proposed adversarial attack method can achieve much higher fooling rates as compared to state-of-the-art universal adversarial attack methods and can realize good generalization on cross-model evaluation.