What is a universal adversarial perturbation, and how does it differ from a per-input one?

## Two shapes an evasion attack can take An adversarial example is an input that a trained model reads wrongly because somebody changed it on purpose, while keeping the change inside a stated size limit so the input stays plausible. Within that definition there are two very different shapes, and they differ in **where the attacker's work sits**. ### Per-input, or bespoke The attacker has one specific input in hand — this listing, this photograph, this binary — and searches for a change tailored to it. The search is guided by the model's response: a gradient if they hold the weights, returned scores or returned labels if they must buy the information by asking. The result is disposable. It works on that input and on essentially nothing else, so attacking a thousand inputs means a thousand searches, and usually a thousand rounds of interaction with the model or with a stand-in the attacker built. ### Input-agnostic, or universal Here the attacker searches once for a **single fixed change that works across many inputs at once**. The search is not over one input but over a sample drawn from the data distribution, and what it is looking for is a change that, at a fixed size, carries a large fraction of that sample across the boundary. What the search produces is an **artefact**: a fixed edit, the same one every time, ready to be pasted onto inputs that were never in the sample and were never shown to the model beforehand. ## A concrete picture A marketplace runs a listing-policy classifier over seller submissions: publish, hold for review, or remove. A network of seller accounts has thousands of its own past listings and the verdict each one received. That is a labelled sample, obtained entirely from their own records — no probing of the platform at all. They use it to fit one edit — a short fixed block of text appended to a listing — and then every account in the network pastes that same block into every listing it files. There is no per-listing attacker work and no per-listing decision to make. ## What actually changes | | Per-input attack | Universal perturbation | |---|---|---| | Where the work happens | Once per target, at attack time | Once, offline, before any target exists | | Interaction with the target | Usually required per target | None once the artefact exists | | Success on a chosen input | Near-certain | A fraction, set by the population | | What is left behind | A change that never repeats | One fixed pattern that repeats everywhere | The marginal cost of the ten-thousandth application of a universal perturbation is zero. That is the whole point of it, and it is why cost controls that meter interaction per target do not engage against this class. ## What it costs the attacker Three things, and a candidate who names only the first is missing the interesting half. 1. **Rate.** One change must work at a fixed size on inputs it was never tuned to. The achievable fraction is far below what a bespoke search gets on its chosen input — a meaningful minority of a population rather than a near-certainty on one item. 2. **A fitting sample.** The attacker needs inputs resembling the ones they will later attack, and either a differentiable copy or a stand-in to search against. If they have neither, they have nothing to fit. 3. **A fixed, matchable artefact.** A bespoke perturbation never repeats, so there is nothing to match. A universal one is the same bytes every time, across every account and every input, which is the one handle this class hands a defender that the bespoke class does not. ## Three things it is not - **It is not noise.** Random change of the same magnitude essentially never flips a trained classifier. The artefact is a specific direction found against a model, and its power comes from that structure, not its size. - **It is not a conditional trained into the weights.** A behaviour planted during training and fired by a key at inference requires write access before or during training. A universal perturbation is fitted against a finished model that the attacker did not modify and could not modify. - **It is not an object placed in a scene.** A physical artefact is bounded by the area and the viewpoint a camera sees rather than by a magnitude limit on a file, and it must survive capture. Different budget, different failure modes. ## Why the distinction shows up in interviews Because the defensive reflex differs. Faced with a bespoke attack, a defender reasons about how much the attacker can learn by asking. Faced with a universal one, there is nothing to learn at attack time — the learning already happened somewhere the defender cannot see — and the questions become what population the artefact's rate was measured over and whether the repeating pattern can be recognised.