Method and system for training a neural network for generating universal adversarial perturbations

Abstract

Embodiments of the present disclosure disclose a method and a system for training a neural network for generating universal adversarial perturbations. The method includes collecting a plurality of data samples. Each of the plurality of data samples is identified by a label from a finite set of labels. The method includes training a probabilistic neural network for transforming the plurality of data samples into a corresponding plurality of perturbed data samples having a bounded probability of deviation from the plurality of data samples by maximizing a conditional entropy of the finite set of labels of the plurality of data samples conditioned on the plurality of perturbed data samples. The conditional entropy is unknown. The probabilistic neural network is trained based on an iterative estimation of a gradient of the unknown conditional entropy of labels. The method further includes generating the universal adversarial perturbations based on the trained probabilistic neural network.