We demonstrate the existence of universal adversarial perturbations, which
can fool a family of audio classification architectures, for both targeted and
untargeted attack scenarios. We propose two methods for finding such
perturbations. The first method is based on an iterative, greedy approach that
is well-known in computer vision: it aggregates small perturbations to the
input so as to push it to the decision boundary. The second method, which is
the main contribution of this work, is a novel penalty formulation, which finds
targeted and untargeted universal adversarial perturbations. Differently from
the greedy approach, the penalty method minimizes an appropriate objective
function on a batch of samples. Therefore, it produces more successful attacks
when the number of training samples is limited. Moreover, we provide a proof
that the proposed penalty method theoretically converges to a solution that
corresponds to universal adversarial perturbations. We also demonstrate that it
is possible to provide successful attacks using the penalty method when only
one sample from the target dataset is available for the attacker. Experimental
results on attacking various 1D CNN architectures have shown attack success
rates higher than 85.0% and 83.1% for targeted and untargeted attacks,
respectively using the proposed penalty method.

本文展示了普适对抗扰动的存在，基于一些新提出的方法，使用惩罚公式可以成功实现针对音频分类体系结构的有目标攻击和无目标攻击。