CITP: Cross-instance targeted perturbations

Universal Adversarial Perturbations (UAPs) differ from traditional image-specific perturbations in that they deceive target models across diverse instances using a single perturbation. Prior research has primarily focused on enhancing the transferability of non-targeted UAPs; however, these efforts fail to generate transferable UAPs capable of classifying images into a specific target class. To address this limitation, we propose a generative adversarial framework named CITP for generating cross-instance targeted perturbations. CITP leverages shared features among instances of the same class to produce perturbations that can be transferred to other instances within that class. The framework distinguishes between generated adversarial samples and images of the target class, enabling it to learn the label distribution of the target class. Additionally, CITP integrates a mid-level feature discriminator to improve the transferability of perturbations across different model architectures. Experimental results demonstrate that CITP exhibits exceptional transferability in cross-instance targeted attacks and achieves strong performance against four defense mechanisms. Notably, CITP extends beyond image data, enabling precise targeted attacks on video data as well.