Uniform-Target Adversarial Examples (UTAEs)

• UTAEs are defined as adversarial examples where the same target is applied uniformly to many inputs, revealing shared vulnerability directions in deep networks.
• They encompass both universal perturbations and image-dependent mappings, achieved via methods such as UANs, ATNs, and GAP++, to enforce a fixed adversarial target.
• FERD extends the idea by using fairness-oriented techniques to distribute attack targets across classes, improving robustness evaluations and addressing bias in adversarial attacks.

Searching arXiv for papers directly relevant to uniform-target adversarial examples, universal targeted attacks, and the FERD formulation. arxiv_search query: "Uniform-Target Adversarial Examples FERD universal targeted adversarial perturbations" Uniform-Target Adversarial Examples (UTAEs) denote adversarial examples whose adversarial objective is shared across many inputs rather than chosen independently for each instance. In the canonical targeted formulation, many inputs are driven toward a fixed target label $y_t$; in the universal case, the same perturbation $\delta$ is also shared across inputs. Closely related work extends this idea to feed-forward generators that map arbitrary inputs to a common target, to target-conditioned generators that realize a fixed target at inference time, and, in a distinct fairness-oriented usage, to adversarial examples whose attack targets are regularized to be uniformly distributed across classes rather than concentrated on a few vulnerable categories (Hayes et al., 2017, Baluja et al., 2017, Mao et al., 2020, Li et al., 25 Sep 2025).

1. Definitions and terminological scope

The core UTAE notion is a targeted adversarial setting in which the target is uniform across inputs. For an input $x \in \mathcal{X} \subset \mathbb{R}^d$, classifier $f : \mathcal{X} \to \mathcal{Y}$, and target label $y_t$, a targeted universal perturbation seeks a single vector $\delta^\star$ such that $\|\delta^\star\|_p \le \epsilon$ and

$$\mathbb{P}_{x \sim \mathcal{D}}\big[f(x+\delta^\star)=y_t\big]\ge \rho.$$

This differs from per-instance targeted attacks, in which the perturbation depends on $x$, and from untargeted universal perturbations, which require only misclassification rather than convergence to a fixed label (Hayes et al., 2017).

A second line of work treats the target as uniform across inputs while allowing the perturbation itself to remain image-dependent. In that setting, a feed-forward mapping $g_{f,t}(x)$ is trained so that $\delta$0 for arbitrary $\delta$1, making the attack uniform in target but not universal in perturbation. A related conditional formulation uses $\delta$2, so that fixing $\delta$3 at inference time realizes a uniform-target regime over all inputs (Baluja et al., 2017, Mao et al., 2020).

A further terminological shift appears in fairness-oriented data-free robustness distillation. There, UTAEs are not defined by a fixed class label $\delta$4; instead, adversarial examples are generated with a uniform target class constraint that pushes the teacher’s output distribution toward the uniform distribution over classes, with the explicit aim of avoiding biased attack directions and distributing attack targets across all categories (Li et al., 25 Sep 2025).

A distinct usage of “uniform” appears in weighted minimax risk for adversarial training, where the contrast is between uniformly weighted attacks over the empirical distribution and non-uniform attacks that reweight vulnerable examples. This usage concerns how examples are sampled or weighted, not a shared misclassification label, but it is relevant because it highlights that “uniform-target” language is not entirely standardized across the literature (Zeng et al., 2020).

Usage	Representative formulation	Representative papers
Universal targeted perturbation	one $\delta$5 for many $\delta$6, fixed $\delta$7	(Hayes et al., 2017)
Image-dependent uniform target	$\delta$8 or $\delta$9 with fixed target at inference	(Baluja et al., 2017, Mao et al., 2020)
Fairness-oriented uniform target	output distribution regularized toward $x \in \mathcal{X} \subset \mathbb{R}^d$0	(Li et al., 25 Sep 2025)
Uniform weighting over examples	equal weighting of adversarial losses over data	(Zeng et al., 2020)

2. Mathematical formulations

The basic targeted UTAE formulation is the targeted universal perturbation constraint

$x \in \mathcal{X} \subset \mathbb{R}^d$1

When the perturbation is generated by a model $x \in \mathcal{X} \subset \mathbb{R}^d$2, one writes $x \in \mathcal{X} \subset \mathbb{R}^d$3, with $x \in \mathcal{X} \subset \mathbb{R}^d$4, and trains $x \in \mathcal{X} \subset \mathbb{R}^d$5 by maximizing the target-label loss under a norm constraint or norm penalty: $x \in \mathcal{X} \subset \mathbb{R}^d$6 or equivalently

$x \in \mathcal{X} \subset \mathbb{R}^d$7

This formulation makes the target uniform because $x \in \mathcal{X} \subset \mathbb{R}^d$8 is fixed for all inputs (Hayes et al., 2017).

In feed-forward targeted transformation networks, the object is not a universal $x \in \mathcal{X} \subset \mathbb{R}^d$9 but a parametric map $f : \mathcal{X} \to \mathcal{Y}$0 such that $f : \mathcal{X} \to \mathcal{Y}$1. The training objective combines an input-space distortion term and an output-space reranking term: $f : \mathcal{X} \to \mathcal{Y}$2 For fixed target $f : \mathcal{X} \to \mathcal{Y}$3, the reranking function $f : \mathcal{X} \to \mathcal{Y}$4 boosts the target class above the current maximum while preserving the relative ordering of the remaining classes as much as possible, producing a uniform-target adversarial mapping over the dataset (Baluja et al., 2017).

GAP++ generalizes this to target-conditioned perturbations. Its generator produces $f : \mathcal{X} \to \mathcal{Y}$5, normalizes it to satisfy an $f : \mathcal{X} \to \mathcal{Y}$6 budget, and forms $f : \mathcal{X} \to \mathcal{Y}$7. The targeted loss sums over both images and targets: $f : \mathcal{X} \to \mathcal{Y}$8 Fixing $f : \mathcal{X} \to \mathcal{Y}$9 at inference yields a uniform-target attack family that is image-dependent but target-uniform (Mao et al., 2020).

The FERD formulation departs from fixed-label targeting. Starting from Fairness-Aware Examples $y_t$0, it constructs UTAEs $y_t$1 by a PGD-like update: $y_t$2 where the first term induces adversarial discrepancy and the second term encourages the prediction on $y_t$3 to approach the uniform distribution $y_t$4. In this formulation, “uniform target” refers to uniformity over attack targets in label space rather than a single fixed target label (Li et al., 25 Sep 2025).

3. Learned constructions and attack architectures

Universal Adversarial Networks (UANs) instantiate the universal targeted setting with a generator $y_t$5 that receives a random vector $y_t$6 and outputs a perturbation $y_t$7 of the same shape as the image. The classifier $y_t$8 is fixed, only $y_t$9 is trained, and perturbations are clipped or projected to satisfy $\delta^\star$0. This construction yields a distribution of universal perturbations rather than a single hand-optimized $\delta^\star$1, and the targeted version is obtained by fixing $\delta^\star$2 in the loss. The method was introduced as an efficiency and flexibility improvement over iterative universal-perturbation procedures that repeatedly compute per-instance adversarial updates such as DeepFool and then aggregate them into a single perturbation (Hayes et al., 2017).

Adversarial Transformation Networks (ATNs) replace universal perturbations with amortized, feed-forward mappings from $\delta^\star$3 to $\delta^\star$4. Two variants are emphasized: P-ATN, which outputs $\delta^\star$5, and AAE ATN, which autoencodes $\delta^\star$6 under adversarial constraints on $\delta^\star$7. The paper’s MNIST experiments literally train ten fixed-target networks, $\delta^\star$8–$\delta^\star$9, each of which maps arbitrary digits toward a single target class; ImageNet experiments similarly target fixed labels such as “binoculars”, “soccer ball”, “volcano”, and “zebra”. The architecture therefore realizes UTAEs as feed-forward, target-specific transformations rather than input-agnostic perturbations (Baluja et al., 2017).

GAP++ moves to a single generator that is conditioned on both the input image and the target label. It models $\|\delta^\star\|_p \le \epsilon$0, enforces explicit $\|\delta^\star\|_p \le \epsilon$1 normalization, and trains one network across all target classes. This subsumes single-target generators as a special case: fixing $\|\delta^\star\|_p \le \epsilon$2 globally at inference yields a uniform-target attack, while allowing $\|\delta^\star\|_p \le \epsilon$3 to vary preserves full multi-target functionality. The paper reports that on MNIST targeted attacks with $\|\delta^\star\|_p \le \epsilon$4, GAP++ uses one model to handle five targets and achieves balanced per-target success rates of 13.3%, 12.8%, 12.8%, 12.0%, and 11.6%, while reducing overall adversarial-set accuracy to 50.5% (Mao et al., 2020).

These constructions differ in what is shared across the attacked population. UANs share both objective and perturbation family across inputs; ATNs and GAP++ share the target objective but allow the perturbation to depend on the image. This suggests a useful conceptual distinction: uniform-target attacks need not be universal in the perturbation sense, even though universal targeted perturbations are the most restrictive and widely studied instance.

4. Transferability, black-box attackability, and multimodal extensions

Transferability is central to the practical significance of UTAEs. Large-scale ImageNet experiments showed that non-targeted adversarial examples transfer readily across ResNet-50/101/152, VGG-16, and GoogLeNet, but targeted adversarial examples generated on a single model almost never transfer with their target labels. The paper attributes this to two geometric properties: gradient directions across models are almost orthogonal, and low-dimensional subspaces explored by single-step methods cover only a small subset of labels. Ensemble-based targeted optimization addresses this by optimizing against the averaged output of multiple models,

$\|\delta^\star\|_p \le \epsilon$5

and minimizing a targeted loss on the ensemble. This was the first setting in which a large proportion of targeted adversarial examples were observed to transfer with their target labels, including to Clarifai.com in a black-box setting (Liu et al., 2016).

A more restrictive black-box scenario is addressed by Siamese-network attacks. There the adversary has only query access to the target model, receives only the atomic class label, has no knowledge of the architecture, and has no access to the training distribution. An unlabeled mismatched dataset is queried to obtain pseudo-labels, a Siamese network is trained on same-label and different-label pairs derived from those outputs, and perturbations learned on the Siamese are transferred back to the target classifier. Candidate perturbations are ranked by

$\|\delta^\star\|_p \le \epsilon$6

and the top-ranked perturbation is then applied uniformly to many target inputs as $\|\delta^\star\|_p \le \epsilon$7. This is untargeted rather than fixed-label targeted, but it demonstrates that broadly effective input-agnostic perturbations can be learned in highly restricted black-box settings (Kulkarni et al., 2018).

In multimodal LLMs, closely related work studies Universal Targeted Transferable Adversarial Attacks (UTTAA), where a single perturbation must steer arbitrary images toward a specified target across unknown commercial MLLMs. MCRMO-Attack addresses three identified obstacles—high-variance target supervision due to crop randomness, unreliable token-wise matching under universality, and initialization sensitivity in few-source per-target adaptation—by combining Multi-Crop Aggregation with an Attention-Guided Crop, alignability-gated Token Routing, and meta-learned perturbation initialization. Across commercial MLLMs, the method improves unseen-image attack success rate by +23.7% on GPT-4o and +19.9% on Gemini-2.0 over the strongest universal baseline, extending the UTAE idea beyond closed-set classification into open-ended captioning and semantic matching (Lu et al., 30 Jan 2026).

A recurring empirical pattern is that targeted transfer is more difficult than untargeted transfer. This is not a minor implementation detail but a structural property of the decision geometry reported across the classification and MLLM settings.

5. Fairness-oriented UTAEs in data-free robustness distillation

FERD introduces UTAEs in a different but influential sense: adversarial examples are constructed from Fairness-Aware Examples (FAEs) so that the attack target distribution is not biased toward a small set of vulnerable classes. The FERD pipeline first synthesizes FAEs by enforcing uniformity on teacher predictions derived from non-robust features,

$\|\delta^\star\|_p \le \epsilon$8

while also optimizing adversarial, BatchNorm-matching, and one-hot confidence terms through

$\|\delta^\star\|_p \le \epsilon$9

UTAEs are then generated from FAEs by maximizing adversarial discrepancy while penalizing deviation from the uniform output distribution, and they are used as the adversarial branch in the student loss

$$\mathbb{P}_{x \sim \mathcal{D}}\big[f(x+\delta^\star)=y_t\big]\ge \rho.$$0

The stated motivation is to avoid biased attack directions, distribute the attack targets across all categories, and improve worst-class robustness (Li et al., 25 Sep 2025).

The fairness motivation is twofold. First, category-wise robustness disparity persists even when synthetic data are generated with equal class proportion. Second, robustness depends strongly on the attack target: attacks targeting some classes cause much more misclassification than attacks targeting others. FERD combines robustness-guided class reweighting, FAEs, and UTAEs so that weakly robust classes receive more synthetic data while the adversarial label-space pressure is diversified rather than concentrated on the easiest target classes (Li et al., 25 Sep 2025).

Setting	Baseline or ablation	FERD result
CIFAR-10, MobileNet-V2, FGSM worst-class robustness	35.70% (DFHL)	50.80%
CIFAR-10, MobileNet-V2, AutoAttack worst-class robustness	13.70% (DFHL)	20.10%
CIFAR-10, ResNet-18, PGD, full FERD vs w/o UTAEs	worst-class 37.40% w/o UTAEs	38.60%
CIFAR-10, ResNet-18, PGD, full FERD vs w/o UTAEs	average robustness 54.19% w/o UTAEs	55.10%

The FERD usage is often a source of confusion because its “uniform target” is not the same as a fixed class $$\mathbb{P}_{x \sim \mathcal{D}}\big[f(x+\delta^\star)=y_t\big]\ge \rho.$$1 imposed on every input. Instead, it is a uniformity constraint over the teacher’s output distribution, introduced specifically to prevent overfitting to a few target classes. This marks a substantive conceptual broadening of the UTAE label.

6. Robustness implications, misconceptions, and open directions

UTAEs expose a global vulnerability that is stronger than ordinary per-instance adversarial examples. The existence of small-norm, input-agnostic perturbations that fool a large fraction of inputs suggests global, low-dimensional vulnerability directions in deep networks. This is operationally significant because a perturbation can be precomputed once and deployed broadly, including in black-box or physical settings where the same pattern is applied to many instances (Hayes et al., 2017).

A common misconception is that uniform-target attacks are synonymous with universal perturbations. The literature does not support that equation. UANs learn universal perturbations; ATNs and GAP++ instead learn image-dependent mappings while keeping the target uniform across inputs; FERD uses “uniform target” to mean uniformity over the distribution of attack targets. Another misconception is that targeted and untargeted transferability differ only quantitatively. The ImageNet ensemble results indicate a sharper distinction: untargeted transfer is comparatively easy, whereas targeted transfer almost never occurs under single-model optimization and requires ensemble-based or otherwise structurally enriched objectives (Liu et al., 2016).

Defensive implications are correspondingly broad. The universal-perturbation literature indicates that evaluating only per-instance attacks can miss substantial vulnerability to shared perturbations. Weighted minimax risk further suggests that even standard adversarial training implicitly assumes uniform weighting over attacked examples and can fail badly under non-uniform attack distributions; on CIFAR-10 with TRADES, robust accuracy under uniform attacks is 53.38%, but the same model drops to $$\mathbb{P}_{x \sim \mathcal{D}}\big[f(x+\delta^\star)=y_t\big]\ge \rho.$$2 and $$\mathbb{P}_{x \sim \mathcal{D}}\big[f(x+\delta^\star)=y_t\big]\ge \rho.$$3 under strong non-uniform attacks, while weighted TRADES improves these to 23.62% and 19.79% respectively (Zeng et al., 2020). This suggests that robustness to UTAEs, robustness to non-uniform attack distributions, and robustness fairness are related but non-identical objectives.

Open directions identified across the literature include stronger ensemble training for transferability, alternative norm constraints and perceptual losses, conditional multi-target generators with fixed-target deployment, and, in the multimodal setting, defenses at the representation level rather than simple stochastic preprocessing. A plausible implication is that future work will continue to separate three axes that were often conflated in earlier discussions: whether perturbations are universal or image-dependent, whether the target is a fixed class or a uniform output distribution, and whether the attack is optimized for a single model or for transfer across a model family.