We show that we can easily design a single adversarial perturbation $P$ that changes the class of $n$ images $X_1,X_2,\dots,X_n$ from their original, unperturbed classes $c_1, c_2,\dots,c_n$ to desired (not necessarily all the same) classes $c^*_1,c^*_2,\dots,c^*_n$ for up to hundreds of images and target classes at once. We call these \textit{multi-attacks}. Characterizing the maximum $n$ we can achieve under different conditions such as image resolution, we estimate the number of regions of high class confidence around a particular image in the space of pixels to be around $10^{\mathcal{O}(100)}$, posing a significant problem for exhaustive defense strategies. We show several immediate consequences of this: adversarial attacks that change the resulting class based on their intensity, and scale-independent adversarial examples. To demonstrate the redundancy and richness of class decision boundaries in the pixel space, we look for its two-dimensional sections that trace images and spell words using particular classes. We also show that ensembling reduces susceptibility to multi-attacks, and that classifiers trained on random labels are more susceptible. Our code is available on GitHub.

翻译：摘要： 我们证明可以轻松设计单个对抗性扰动 $P$，使得对多达数百张图像 $X_1,X_2,\dots,X_n$ 及其对应目标类别 $c^*_1,c^*_2,\dots,c^*_n$（不必全部相同），能够将其原始未受扰动类别 $c_1, c_2,\dots,c_n$ 同时改变。我们将此类方法称为“多重攻击”。通过刻画不同条件（如图像分辨率）下可达到的最大 $n$ 值，我们估计在像素空间中每幅图像附近的高置信度类别区域数量约为 $10^{\mathcal{O}(100)}$，这对穷举防御策略构成了重大挑战。我们展示了此方法的若干直接应用：基于扰动强度改变输出类别的对抗攻击，以及尺度无关的对抗样本。为揭示像素空间中类别决策边界的冗余性与丰富性，我们探索了其二维截面，这些截面既可追踪图像轨迹，又能利用特定类别拼写单词。实验表明，集成学习可降低对多重攻击的敏感性，而基于随机标签训练的分类器则更易受影响。我们的代码已发布于 GitHub。